{"grype_matches":[{"artifact":{"id":"7586cb016f638ae5","cpes":["cpe:2.3:a:libevent-2.1-7t64:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1-7t64:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1_7t64:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1_7t64:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*"],"name":"libevent-2.1-7t64","purl":"pkg:deb/ubuntu/libevent-2.1-7t64@2.1.12-stable-9ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=libevent","type":"deb","version":"2.1.12-stable-9ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-2.1-7t64/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/libevent-2.1-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-2.1-7t64.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libevent-2.1-7t64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-2.1-7t64.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libevent-2.1-7t64.list"}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libevent","version":"2.1.12-stable-9ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63379","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-10","epss":0.00518,"percentile":0.44407}],"risk":0.259,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63379"},"relatedVulnerabilities":[{"id":"CVE-2026-63379","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-10","epss":0.00518,"percentile":0.44407}],"urls":["https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63379","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"7586cb016f638ae5","cpes":["cpe:2.3:a:libevent-2.1-7t64:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1-7t64:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1_7t64:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1_7t64:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*"],"name":"libevent-2.1-7t64","purl":"pkg:deb/ubuntu/libevent-2.1-7t64@2.1.12-stable-9ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=libevent","type":"deb","version":"2.1.12-stable-9ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-2.1-7t64/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/libevent-2.1-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-2.1-7t64.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libevent-2.1-7t64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-2.1-7t64.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libevent-2.1-7t64.list"}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libevent","version":"2.1.12-stable-9ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-10","epss":0.00416,"percentile":0.36203}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63387"},"relatedVulnerabilities":[{"id":"CVE-2026-63387","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-10","epss":0.00416,"percentile":0.36203}],"urls":["https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63387","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"65e17d5434ad129c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-10","epss":0.00297,"percentile":0.22605}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-10","epss":0.00297,"percentile":0.22605}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"65e17d5434ad129c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-10","epss":0.00281,"percentile":0.20777}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-10","epss":0.00281,"percentile":0.20777}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"c5d4945392b49ff7","cpes":["cpe:2.3:a:coreutils:coreutils:9.4-3ubuntu6.3:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"9.4-3ubuntu6.3","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"coreutils","version":"9.4-3ubuntu6.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-10","epss":0.00428,"percentile":0.37367}],"risk":0.1284,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2781"},"relatedVulnerabilities":[{"id":"CVE-2016-2781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-10","epss":0.00428,"percentile":0.37367}],"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."}]},{"artifact":{"id":"65e17d5434ad129c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-20013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-11-10","epss":0.02174,"percentile":0.82459}],"risk":0.1087,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20013"},"relatedVulnerabilities":[{"id":"CVE-2016-20013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-11-10","epss":0.02174,"percentile":0.82459}],"urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password."}]},{"artifact":{"id":"7586cb016f638ae5","cpes":["cpe:2.3:a:libevent-2.1-7t64:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1-7t64:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1_7t64:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1_7t64:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent-2.1:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent_2.1:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-2.1-7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_2.1_7t64:2.1.12-stable-9ubuntu2.2:*:*:*:*:*:*:*"],"name":"libevent-2.1-7t64","purl":"pkg:deb/ubuntu/libevent-2.1-7t64@2.1.12-stable-9ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=libevent","type":"deb","version":"2.1.12-stable-9ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-2.1-7t64/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/libevent-2.1-7t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-2.1-7t64.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libevent-2.1-7t64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-2.1-7t64.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libevent-2.1-7t64.list"}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libevent","version":"2.1.12-stable-9ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63380","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63380","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63380","date":"2026-11-10","epss":0.0014,"percentile":0.03421}],"risk":0.06999999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63380"},"relatedVulnerabilities":[{"id":"CVE-2026-63380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63380","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63380","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63380","date":"2026-11-10","epss":0.0014,"percentile":0.03421}],"urls":["https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63380","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha."}]},{"artifact":{"id":"32ba3aab4ae25dcb","cpes":["cpe:2.3:a:dash:dash:0.5.12-6ubuntu5:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.5.12-6ubuntu5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/dash.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102474","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"dash","version":"0.5.12-6ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102474","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-10","epss":0.00113,"percentile":0.01425}],"risk":0.056499999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102474"},"relatedVulnerabilities":[{"id":"CVE-2026-102474","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-10","epss":0.00113,"percentile":0.01425}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102474","https://bugzilla.redhat.com/show_bug.cgi?id=2543004"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102474","description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation."}]},{"artifact":{"id":"32ba3aab4ae25dcb","cpes":["cpe:2.3:a:dash:dash:0.5.12-6ubuntu5:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.5.12-6ubuntu5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/dash.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"dash","version":"0.5.12-6ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-10","epss":0.00102,"percentile":0.00937}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102473"},"relatedVulnerabilities":[{"id":"CVE-2026-102473","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-10","epss":0.00102,"percentile":0.00937}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102473","https://bugzilla.redhat.com/show_bug.cgi?id=2543005"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102473","description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}]},{"artifact":{"id":"65e17d5434ad129c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.md5sums","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6.list","layerID":"sha256:2f005b5552ec892430d37701ef15c301bffae8a57db9a8ee1c4cb2b3a5cd109c","accessPath":"/var/lib/dpkg/info/libc6.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-10","epss":0.00102,"percentile":0.00934}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-10","epss":0.00102,"percentile":0.00934}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]}],"grade":"A","score":"100.00","as_of":"2026-11-12T04:35:58.138Z","grype_db_version":"2026-11-11T06:21:32.000Z"}