{"grype_matches":[{"artifact":{"id":"5d5e6e68ac2ba7b9","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5f2m-466j-3848","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-5f2m-466j-3848","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0981","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981","https://github.com/dotnet/announcements/issues/113","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5f2m-466j-3848","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0981","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0981","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980."}]},{"artifact":{"id":"c4e72ac7f1bde673","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5f2m-466j-3848","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-5f2m-466j-3848","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0981","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981","https://github.com/dotnet/announcements/issues/113","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5f2m-466j-3848","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0981","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0981","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980."}]},{"artifact":{"id":"bdf664761f147504","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5f2m-466j-3848","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-5f2m-466j-3848","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0981","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981","https://github.com/dotnet/announcements/issues/113","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5f2m-466j-3848","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0981","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0981","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980."}]},{"artifact":{"id":"df54d41ba7f0d1c1","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Common.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Common.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5f2m-466j-3848","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-5f2m-466j-3848","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0981","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981","https://github.com/dotnet/announcements/issues/113","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5f2m-466j-3848","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0981","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0981","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980."}]},{"artifact":{"id":"e994c662c1cc2643","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5f2m-466j-3848","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-5f2m-466j-3848","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0981","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981","https://github.com/dotnet/announcements/issues/113","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5f2m-466j-3848","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0981","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0981","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980."}]},{"artifact":{"id":"f56688673fdbf7bd","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5f2m-466j-3848","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-5f2m-466j-3848","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0981","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981","https://github.com/dotnet/announcements/issues/113","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5f2m-466j-3848","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0981","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0981","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0981","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0981","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980."}]},{"artifact":{"id":"bdf664761f147504","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhfc-gr8f-ffwc","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-xhfc-gr8f-ffwc","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0980","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980","https://github.com/dotnet/announcements/issues/112","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhfc-gr8f-ffwc","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0980","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981."}]},{"artifact":{"id":"e994c662c1cc2643","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhfc-gr8f-ffwc","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-xhfc-gr8f-ffwc","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0980","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980","https://github.com/dotnet/announcements/issues/112","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhfc-gr8f-ffwc","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0980","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981."}]},{"artifact":{"id":"5d5e6e68ac2ba7b9","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhfc-gr8f-ffwc","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-xhfc-gr8f-ffwc","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0980","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980","https://github.com/dotnet/announcements/issues/112","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhfc-gr8f-ffwc","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0980","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981."}]},{"artifact":{"id":"c4e72ac7f1bde673","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhfc-gr8f-ffwc","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-xhfc-gr8f-ffwc","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0980","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980","https://github.com/dotnet/announcements/issues/112","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhfc-gr8f-ffwc","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0980","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981."}]},{"artifact":{"id":"f56688673fdbf7bd","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhfc-gr8f-ffwc","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-xhfc-gr8f-ffwc","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0980","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980","https://github.com/dotnet/announcements/issues/112","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhfc-gr8f-ffwc","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0980","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981."}]},{"artifact":{"id":"df54d41ba7f0d1c1","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Common.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Common.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xhfc-gr8f-ffwc","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-xhfc-gr8f-ffwc","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"risk":3.70725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0980","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980","https://github.com/dotnet/announcements/issues/112","https://github.com/github/advisory-database/issues/302"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xhfc-gr8f-ffwc","description":"Denial of service in ASP.NET Core"},"relatedVulnerabilities":[{"id":"CVE-2019-0980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0980","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0980","date":"2026-10-25","epss":0.04943,"percentile":0.92093}],"urls":["https://access.redhat.com/errata/RHSA-2019:1259","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0980","description":"A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981."}]},{"artifact":{"id":"bdf664761f147504","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5qj-9vmx-7g6g","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-x5qj-9vmx-7g6g","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-09","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"risk":2.46231,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0657","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657","http://www.securityfocus.com/bid/106890","https://github.com/dotnet/announcements/issues/97","https://github.com/github/advisory-database/issues/302"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5qj-9vmx-7g6g","description":"Improper Input Validation in .Net Framework API's"},"relatedVulnerabilities":[{"id":"CVE-2019-0657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"urls":["http://www.securityfocus.com/bid/106890","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0657","description":"A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'."}]},{"artifact":{"id":"f56688673fdbf7bd","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5qj-9vmx-7g6g","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-x5qj-9vmx-7g6g","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-09","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"risk":2.46231,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0657","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657","http://www.securityfocus.com/bid/106890","https://github.com/dotnet/announcements/issues/97","https://github.com/github/advisory-database/issues/302"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5qj-9vmx-7g6g","description":"Improper Input Validation in .Net Framework API's"},"relatedVulnerabilities":[{"id":"CVE-2019-0657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"urls":["http://www.securityfocus.com/bid/106890","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0657","description":"A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'."}]},{"artifact":{"id":"5d5e6e68ac2ba7b9","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5qj-9vmx-7g6g","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-x5qj-9vmx-7g6g","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-09","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"risk":2.46231,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0657","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657","http://www.securityfocus.com/bid/106890","https://github.com/dotnet/announcements/issues/97","https://github.com/github/advisory-database/issues/302"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5qj-9vmx-7g6g","description":"Improper Input Validation in .Net Framework API's"},"relatedVulnerabilities":[{"id":"CVE-2019-0657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"urls":["http://www.securityfocus.com/bid/106890","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0657","description":"A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'."}]},{"artifact":{"id":"c4e72ac7f1bde673","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5qj-9vmx-7g6g","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-x5qj-9vmx-7g6g","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-09","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"risk":2.46231,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0657","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657","http://www.securityfocus.com/bid/106890","https://github.com/dotnet/announcements/issues/97","https://github.com/github/advisory-database/issues/302"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5qj-9vmx-7g6g","description":"Improper Input Validation in .Net Framework API's"},"relatedVulnerabilities":[{"id":"CVE-2019-0657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"urls":["http://www.securityfocus.com/bid/106890","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0657","description":"A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'."}]},{"artifact":{"id":"df54d41ba7f0d1c1","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Common.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Common.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5qj-9vmx-7g6g","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-x5qj-9vmx-7g6g","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-09","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"risk":2.46231,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0657","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657","http://www.securityfocus.com/bid/106890","https://github.com/dotnet/announcements/issues/97","https://github.com/github/advisory-database/issues/302"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5qj-9vmx-7g6g","description":"Improper Input Validation in .Net Framework API's"},"relatedVulnerabilities":[{"id":"CVE-2019-0657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"urls":["http://www.securityfocus.com/bid/106890","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0657","description":"A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'."}]},{"artifact":{"id":"e994c662c1cc2643","cpes":["cpe:2.3:a:system_private_uri:system_private_uri_.net:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:system_private_uri:system_private_uri:4.3.0:*:*:*:*:*:*:*"],"name":"System.Private.Uri","purl":"pkg:nuget/System.Private.Uri@4.3.0","type":"dotnet","version":"4.3.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x5qj-9vmx-7g6g","versionConstraint":">=4.3.0,<4.3.2 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Private.Uri","version":"4.3.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-x5qj-9vmx-7g6g","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2022-07-09","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"risk":2.46231,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0657","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657","http://www.securityfocus.com/bid/106890","https://github.com/dotnet/announcements/issues/97","https://github.com/github/advisory-database/issues/302"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x5qj-9vmx-7g6g","description":"Improper Input Validation in .Net Framework API's"},"relatedVulnerabilities":[{"id":"CVE-2019-0657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0657","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0657","date":"2026-10-25","epss":0.04518,"percentile":0.91461}],"urls":["http://www.securityfocus.com/bid/106890","https://access.redhat.com/errata/RHSA-2019:0349","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0657","description":"A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-25","epss":0.01284,"percentile":0.6991}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"db3686e392cad366","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"a6b2cd3e91fa9f71","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"e5dcdf668b486ae5","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"fa750538e5b50088","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"d55523481d0b064c","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-10-25","epss":0.00991,"percentile":0.62285}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"fa750538e5b50088","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"d55523481d0b064c","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"db3686e392cad366","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"a6b2cd3e91fa9f71","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"e5dcdf668b486ae5","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-10-25","epss":0.00895,"percentile":0.59246}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"b7db03e28182d0f4","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d126fa9a14843a0b","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b82005f3f0f7ef42","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"bdf04c568ca09005","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7e5602eec3aa6866","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7056b49d651734b2","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-10-25","epss":0.0039,"percentile":0.32886}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7056b49d651734b2","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b7db03e28182d0f4","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d126fa9a14843a0b","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"bdf04c568ca09005","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7e5602eec3aa6866","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b82005f3f0f7ef42","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7056b49d651734b2","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7e5602eec3aa6866","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d126fa9a14843a0b","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"bdf04c568ca09005","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b82005f3f0f7ef42","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b7db03e28182d0f4","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-10-25","epss":0.00385,"percentile":0.32324}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-25","epss":0.00428,"percentile":0.36796}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-25","epss":0.00428,"percentile":0.36796}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-25","epss":0.00428,"percentile":0.36796}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-25","epss":0.00428,"percentile":0.36796}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-25","epss":0.00312,"percentile":0.23868}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-25","epss":0.00312,"percentile":0.23868}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-25","epss":0.00312,"percentile":0.23868}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"bdf04c568ca09005","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7056b49d651734b2","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b7db03e28182d0f4","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b82005f3f0f7ef42","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d126fa9a14843a0b","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7e5602eec3aa6866","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b82005f3f0f7ef42","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.SignalR.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"bdf04c568ca09005","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Http.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"b7db03e28182d0f4","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7056b49d651734b2","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Api.V3.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"7e5602eec3aa6866","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Core.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d126fa9a14843a0b","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/radarr/bin/Radarr.Host.deps.json","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/Radarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/radarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/app/radarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.1.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<=4.1.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["4.1.2"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"4.1.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-10-25","epss":0.00328,"percentile":0.25736}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"risk":0.1485,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"risk":0.1485,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-25","epss":0.00297,"percentile":0.22141}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"risk":0.14100000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"risk":0.14100000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-25","epss":0.00282,"percentile":0.20551}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"risk":0.13949999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"risk":0.13949999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-25","epss":0.00279,"percentile":0.20108}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"risk":0.131,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"risk":0.131,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-25","epss":0.00262,"percentile":0.17882}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"risk":0.13,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"risk":0.13,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-25","epss":0.0026,"percentile":0.17558}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"risk":0.1295,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"risk":0.1295,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[],"epss":[{"cve":"CVE-2026-86409","date":"2026-10-25","epss":0.00259,"percentile":0.17432}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"risk":0.1205,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"risk":0.1205,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-25","epss":0.00241,"percentile":0.15048}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-25","epss":0.00219,"percentile":0.12256}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"risk":0.1095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-25","epss":0.00219,"percentile":0.12255}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"risk":0.106,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-25","epss":0.00212,"percentile":0.11347}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"risk":0.1035,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"risk":0.1035,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-25","epss":0.00207,"percentile":0.10736}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"risk":0.1005,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"risk":0.1005,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-25","epss":0.00201,"percentile":0.09822}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"risk":0.0985,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"risk":0.0985,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[],"epss":[{"cve":"CVE-2026-107929","date":"2026-10-25","epss":0.00197,"percentile":0.09333}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"risk":0.09749999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"risk":0.09749999999999999,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[],"epss":[{"cve":"CVE-2026-94266","date":"2026-10-25","epss":0.00195,"percentile":0.09121}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"risk":0.091,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"risk":0.091,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[],"epss":[{"cve":"CVE-2026-87864","date":"2026-10-25","epss":0.00182,"percentile":0.07708}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"risk":0.0895,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"risk":0.0895,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[],"epss":[{"cve":"CVE-2026-86415","date":"2026-10-25","epss":0.00179,"percentile":0.0739}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"risk":0.086,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"risk":0.086,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[],"epss":[{"cve":"CVE-2026-87866","date":"2026-10-25","epss":0.00172,"percentile":0.0656}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-25","epss":0.00186,"percentile":0.08133}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-25","epss":0.00186,"percentile":0.08133}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-25","epss":0.00186,"percentile":0.08133}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-25","epss":0.00186,"percentile":0.08133}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-25","epss":0.00131,"percentile":0.02685}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-25","epss":0.00131,"percentile":0.02685}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-25","epss":0.00131,"percentile":0.02685}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-25","epss":0.00131,"percentile":0.02685}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"risk":0.063,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:a0dc3c720e97993e141e09023625a863623bdb1dfb2d2545e71cc3c51d8ec986","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"risk":0.063,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[],"epss":[{"cve":"CVE-2026-86411","date":"2026-10-25","epss":0.00126,"percentile":0.02255}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]}],"grade":"F","score":"0.00","as_of":"2026-10-26T09:13:10.258Z","grype_db_version":"2026-10-26T06:38:44.000Z"}