{"grype_matches":[{"artifact":{"id":"7e2ddf04583be5b0","cpes":["cpe:2.3:a:grafana:loki\\/v3:v3.0.0-20261113001030-c792f58577a4:*:*:*:*:*:*:*"],"name":"github.com/grafana/loki/v3","purl":"pkg:golang/github.com/grafana/loki/v3@v3.0.0-20261113001030-c792f58577a4","type":"go-module","version":"v3.0.0-20261113001030-c792f58577a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/grafana/loki/v3","architecture":"amd64","goBuildSettings":[{"key":"-buildmode","value":"exe"},{"key":"-compiler","value":"gc"},{"key":"-ldflags","value":"-extldflags \"-static\" -s -w -X github.com/grafana/loki/v3/pkg/util/build.Branch=release-3.7.x -X github.com/grafana/loki/v3/pkg/util/build.Version=3.7.10 -X github.com/grafana/loki/v3/pkg/util/build.Revision=c792f585 -X github.com/grafana/loki/v3/pkg/util/build.BuildUser=root@buildkitsandbox -X github.com/grafana/loki/v3/pkg/util/build.BuildDate=2026-11-13T00:20:40Z"},{"key":"-tags","value":"netgo"},{"key":"CGO_ENABLED","value":"0"},{"key":"GOARCH","value":"amd64"},{"key":"GOOS","value":"linux"},{"key":"GOAMD64","value":"v1"},{"key":"vcs","value":"git"},{"key":"vcs.revision","value":"c792f58577a46c64b0a8e808d7c643ed0e8c5e83"},{"key":"vcs.time","value":"2026-11-13T00:10:30Z"},{"key":"vcs.modified","value":"false"}],"goCompiledVersion":"go1.26.10"},"locations":[{"path":"/usr/bin/loki","layerID":"sha256:775a1afc5ed44a3dafb61ed2164cd5e42f970f091a771dd1adaefd44caeac25c","accessPath":"/usr/bin/loki","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.6.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-497x-rrr9-68jp","versionConstraint":"<3.6.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/grafana/loki/v3","version":"v3.0.0-20261113001030-c792f58577a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-497x-rrr9-68jp","fix":{"state":"fixed","versions":["3.6.4"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"3.6.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21726","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21726","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"risk":0.21887500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-21726","https://grafana.com/security/security-advisories/cve-2026-21726"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-497x-rrr9-68jp","description":"Grafana Loki Path Traversal - CVE-2021-36156 Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-21726","cvss":[{"type":"Secondary","source":"security@grafana.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21726","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21726","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"urls":["https://grafana.com/security/security-advisories/cve-2026-21726"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21726","description":"The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability."}]},{"artifact":{"id":"42b176e0db64a136","cpes":["cpe:2.3:a:golang:go:1.26.10:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.10","type":"go-module","version":"go1.26.10","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.10"},"locations":[{"path":"/usr/bin/loki","layerID":"sha256:775a1afc5ed44a3dafb61ed2164cd5e42f970f091a771dd1adaefd44caeac25c","accessPath":"/usr/bin/loki","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6859","versionConstraint":"<1.26.11||>=1.27.0-0,<1.27.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.10"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6859","fix":{"state":"fixed","versions":["1.26.11","1.27.4"],"available":[{"date":"2026-11-10","kind":"release","version":"1.26.11"},{"date":"2026-11-10","kind":"release","version":"1.27.4"}]},"cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"risk":0.08549999999999999,"urls":["https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/862185","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."},"relatedVulnerabilities":[{"id":"CVE-2026-97054","cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"urls":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97054","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."}]}],"grade":"A","score":"100.00","as_of":"2026-11-14T06:51:56.898Z","grype_db_version":"2026-11-13T15:40:34.000Z"}