{"grype_matches":[{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-12","epss":0.01284,"percentile":0.70529}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-12","epss":0.01166,"percentile":0.67764}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"risk":0.8548800000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"risk":0.8548800000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-12","epss":0.01096,"percentile":0.66046}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"risk":0.8151,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"risk":0.8151,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-12","epss":0.01045,"percentile":0.64615}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"risk":0.7761,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"risk":0.7761,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-12","epss":0.00995,"percentile":0.6314}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-12","epss":0.00776,"percentile":0.56282}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-12","epss":0.00731,"percentile":0.54794}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-12","epss":0.00828,"percentile":0.57988}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-12","epss":0.00828,"percentile":0.57987}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-12","epss":0.00699,"percentile":0.53631}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-12","epss":0.00676,"percentile":0.52745}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"risk":0.59748,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"risk":0.59748,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-12","epss":0.00766,"percentile":0.55977}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"risk":0.56238,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"risk":0.56238,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-12","epss":0.00721,"percentile":0.54439}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"risk":0.5499,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"risk":0.5499,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-12","epss":0.00705,"percentile":0.53842}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"risk":0.52026,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"risk":0.52026,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-12","epss":0.00667,"percentile":0.52376}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"risk":0.46155000000000007,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"risk":0.46155000000000007,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-12","epss":0.0051,"percentile":0.43991}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"risk":0.44998,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"risk":0.44998,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-12","epss":0.00604,"percentile":0.49432}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-12","epss":0.00589,"percentile":0.48673}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69650","versionConstraint":"<= 2.46 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69650","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69650","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-69650","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69650","date":"2026-11-12","epss":0.00588,"percentile":0.4862}],"risk":0.441,"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33698","https://sourceware.org/bugzilla/show_bug.cgi?id=33700","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=81e90cf63a10ad11772c2437c8f2a88f1a00c739","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=ea4bc025abdba85a90e26e13f551c16a44bfa92","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69650","description":"GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version."},"relatedVulnerabilities":[]},{"artifact":{"id":"74e627fce3b27b64","cpes":["cpe:2.3:a:musl-libc:musl:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.2.6-r3:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/alpine/musl@1.2.6-r3?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"1.2.6-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/lib/libc.musl-x86_64.so.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.6-r6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107891","versionConstraint":"< 1.2.6-r6 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"musl","version":"1.2.6-r3"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"1.2.6-r6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107891","versionConstraint":"< 1.2.6-r6 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"musl","version":"1.2.6-r3"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107891","fix":{"state":"fixed","versions":["1.2.6-r6"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"1.2.6-r6"}]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107891","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107891","date":"2026-11-12","epss":0.00549,"percentile":0.46443}],"risk":0.42822,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107891"},"relatedVulnerabilities":[{"id":"CVE-2026-107891","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107891","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107891","date":"2026-11-12","epss":0.00549,"percentile":0.46443}],"urls":["https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941","https://musl.libc.org","https://www.openwall.com/lists/musl/2026/10/21/1","http://www.openwall.com/lists/oss-security/2026/10/21/18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107891","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}]},{"artifact":{"id":"5162ee88d2a2e24d","cpes":["cpe:2.3:a:musl-libc:musl-dev:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl-libc:musl_dev:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl-dev:musl-dev:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl-dev:musl_dev:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl_dev:musl-dev:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl_dev:musl_dev:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl-dev:1.2.6-r3:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl_dev:1.2.6-r3:*:*:*:*:*:*:*"],"name":"musl-dev","purl":"pkg:apk/alpine/musl-dev@1.2.6-r3?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=musl","type":"apk","version":"1.2.6-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/include"},{"path":"/usr/include/aio.h"},{"path":"/usr/include/alloca.h"},{"path":"/usr/include/ar.h"},{"path":"/usr/include/assert.h"},{"path":"/usr/include/byteswap.h"},{"path":"/usr/include/complex.h"},{"path":"/usr/include/cpio.h"},{"path":"/usr/include/crypt.h"},{"path":"/usr/include/ctype.h"},{"path":"/usr/include/dirent.h"},{"path":"/usr/include/dlfcn.h"},{"path":"/usr/include/elf.h"},{"path":"/usr/include/endian.h"},{"path":"/usr/include/err.h"},{"path":"/usr/include/errno.h"},{"path":"/usr/include/fcntl.h"},{"path":"/usr/include/features.h"},{"path":"/usr/include/fenv.h"},{"path":"/usr/include/float.h"},{"path":"/usr/include/fmtmsg.h"},{"path":"/usr/include/fnmatch.h"},{"path":"/usr/include/ftw.h"},{"path":"/usr/include/getopt.h"},{"path":"/usr/include/glob.h"},{"path":"/usr/include/grp.h"},{"path":"/usr/include/iconv.h"},{"path":"/usr/include/ifaddrs.h"},{"path":"/usr/include/inttypes.h"},{"path":"/usr/include/iso646.h"},{"path":"/usr/include/langinfo.h"},{"path":"/usr/include/lastlog.h"},{"path":"/usr/include/libgen.h"},{"path":"/usr/include/limits.h"},{"path":"/usr/include/link.h"},{"path":"/usr/include/locale.h"},{"path":"/usr/include/malloc.h"},{"path":"/usr/include/math.h"},{"path":"/usr/include/memory.h"},{"path":"/usr/include/mntent.h"},{"path":"/usr/include/monetary.h"},{"path":"/usr/include/mqueue.h"},{"path":"/usr/include/netdb.h"},{"path":"/usr/include/nl_types.h"},{"path":"/usr/include/paths.h"},{"path":"/usr/include/poll.h"},{"path":"/usr/include/pthread.h"},{"path":"/usr/include/pty.h"},{"path":"/usr/include/pwd.h"},{"path":"/usr/include/regex.h"},{"path":"/usr/include/resolv.h"},{"path":"/usr/include/sched.h"},{"path":"/usr/include/search.h"},{"path":"/usr/include/semaphore.h"},{"path":"/usr/include/setjmp.h"},{"path":"/usr/include/shadow.h"},{"path":"/usr/include/signal.h"},{"path":"/usr/include/spawn.h"},{"path":"/usr/include/stdalign.h"},{"path":"/usr/include/stdarg.h"},{"path":"/usr/include/stdbool.h"},{"path":"/usr/include/stdc-predef.h"},{"path":"/usr/include/stddef.h"},{"path":"/usr/include/stdint.h"},{"path":"/usr/include/stdio.h"},{"path":"/usr/include/stdio_ext.h"},{"path":"/usr/include/stdlib.h"},{"path":"/usr/include/stdnoreturn.h"},{"path":"/usr/include/string.h"},{"path":"/usr/include/strings.h"},{"path":"/usr/include/stropts.h"},{"path":"/usr/include/syscall.h"},{"path":"/usr/include/sysexits.h"},{"path":"/usr/include/syslog.h"},{"path":"/usr/include/tar.h"},{"path":"/usr/include/termios.h"},{"path":"/usr/include/tgmath.h"},{"path":"/usr/include/threads.h"},{"path":"/usr/include/time.h"},{"path":"/usr/include/uchar.h"},{"path":"/usr/include/ucontext.h"},{"path":"/usr/include/ulimit.h"},{"path":"/usr/include/unistd.h"},{"path":"/usr/include/utime.h"},{"path":"/usr/include/utmp.h"},{"path":"/usr/include/utmpx.h"},{"path":"/usr/include/values.h"},{"path":"/usr/include/wait.h"},{"path":"/usr/include/wchar.h"},{"path":"/usr/include/wctype.h"},{"path":"/usr/include/wordexp.h"},{"path":"/usr/include/arpa"},{"path":"/usr/include/arpa/ftp.h"},{"path":"/usr/include/arpa/inet.h"},{"path":"/usr/include/arpa/nameser.h"},{"path":"/usr/include/arpa/nameser_compat.h"},{"path":"/usr/include/arpa/telnet.h"},{"path":"/usr/include/arpa/tftp.h"},{"path":"/usr/include/bits"},{"path":"/usr/include/bits/alltypes.h"},{"path":"/usr/include/bits/dirent.h"},{"path":"/usr/include/bits/errno.h"},{"path":"/usr/include/bits/fcntl.h"},{"path":"/usr/include/bits/fenv.h"},{"path":"/usr/include/bits/float.h"},{"path":"/usr/include/bits/hwcap.h"},{"path":"/usr/include/bits/io.h"},{"path":"/usr/include/bits/ioctl.h"},{"path":"/usr/include/bits/ioctl_fix.h"},{"path":"/usr/include/bits/ipc.h"},{"path":"/usr/include/bits/ipcstat.h"},{"path":"/usr/include/bits/kd.h"},{"path":"/usr/include/bits/limits.h"},{"path":"/usr/include/bits/link.h"},{"path":"/usr/include/bits/mman.h"},{"path":"/usr/include/bits/msg.h"},{"path":"/usr/include/bits/poll.h"},{"path":"/usr/include/bits/ptrace.h"},{"path":"/usr/include/bits/reg.h"},{"path":"/usr/include/bits/resource.h"},{"path":"/usr/include/bits/sem.h"},{"path":"/usr/include/bits/setjmp.h"},{"path":"/usr/include/bits/shm.h"},{"path":"/usr/include/bits/signal.h"},{"path":"/usr/include/bits/socket.h"},{"path":"/usr/include/bits/soundcard.h"},{"path":"/usr/include/bits/stat.h"},{"path":"/usr/include/bits/statfs.h"},{"path":"/usr/include/bits/stdint.h"},{"path":"/usr/include/bits/syscall.h"},{"path":"/usr/include/bits/termios.h"},{"path":"/usr/include/bits/user.h"},{"path":"/usr/include/bits/vt.h"},{"path":"/usr/include/net"},{"path":"/usr/include/net/ethernet.h"},{"path":"/usr/include/net/if.h"},{"path":"/usr/include/net/if_arp.h"},{"path":"/usr/include/net/route.h"},{"path":"/usr/include/netinet"},{"path":"/usr/include/netinet/ether.h"},{"path":"/usr/include/netinet/icmp6.h"},{"path":"/usr/include/netinet/if_ether.h"},{"path":"/usr/include/netinet/igmp.h"},{"path":"/usr/include/netinet/in.h"},{"path":"/usr/include/netinet/in_systm.h"},{"path":"/usr/include/netinet/ip.h"},{"path":"/usr/include/netinet/ip6.h"},{"path":"/usr/include/netinet/ip_icmp.h"},{"path":"/usr/include/netinet/tcp.h"},{"path":"/usr/include/netinet/udp.h"},{"path":"/usr/include/netpacket"},{"path":"/usr/include/netpacket/packet.h"},{"path":"/usr/include/scsi"},{"path":"/usr/include/scsi/scsi.h"},{"path":"/usr/include/scsi/scsi_ioctl.h"},{"path":"/usr/include/scsi/sg.h"},{"path":"/usr/include/sys"},{"path":"/usr/include/sys/acct.h"},{"path":"/usr/include/sys/auxv.h"},{"path":"/usr/include/sys/cachectl.h"},{"path":"/usr/include/sys/dir.h"},{"path":"/usr/include/sys/epoll.h"},{"path":"/usr/include/sys/errno.h"},{"path":"/usr/include/sys/eventfd.h"},{"path":"/usr/include/sys/fanotify.h"},{"path":"/usr/include/sys/fcntl.h"},{"path":"/usr/include/sys/file.h"},{"path":"/usr/include/sys/fsuid.h"},{"path":"/usr/include/sys/inotify.h"},{"path":"/usr/include/sys/io.h"},{"path":"/usr/include/sys/ioctl.h"},{"path":"/usr/include/sys/ipc.h"},{"path":"/usr/include/sys/kd.h"},{"path":"/usr/include/sys/klog.h"},{"path":"/usr/include/sys/membarrier.h"},{"path":"/usr/include/sys/mman.h"},{"path":"/usr/include/sys/mount.h"},{"path":"/usr/include/sys/msg.h"},{"path":"/usr/include/sys/mtio.h"},{"path":"/usr/include/sys/param.h"},{"path":"/usr/include/sys/personality.h"},{"path":"/usr/include/sys/poll.h"},{"path":"/usr/include/sys/prctl.h"},{"path":"/usr/include/sys/procfs.h"},{"path":"/usr/include/sys/ptrace.h"},{"path":"/usr/include/sys/quota.h"},{"path":"/usr/include/sys/random.h"},{"path":"/usr/include/sys/reboot.h"},{"path":"/usr/include/sys/reg.h"},{"path":"/usr/include/sys/resource.h"},{"path":"/usr/include/sys/select.h"},{"path":"/usr/include/sys/sem.h"},{"path":"/usr/include/sys/sendfile.h"},{"path":"/usr/include/sys/shm.h"},{"path":"/usr/include/sys/signal.h"},{"path":"/usr/include/sys/signalfd.h"},{"path":"/usr/include/sys/socket.h"},{"path":"/usr/include/sys/soundcard.h"},{"path":"/usr/include/sys/stat.h"},{"path":"/usr/include/sys/statfs.h"},{"path":"/usr/include/sys/statvfs.h"},{"path":"/usr/include/sys/stropts.h"},{"path":"/usr/include/sys/swap.h"},{"path":"/usr/include/sys/syscall.h"},{"path":"/usr/include/sys/sysinfo.h"},{"path":"/usr/include/sys/syslog.h"},{"path":"/usr/include/sys/sysmacros.h"},{"path":"/usr/include/sys/termios.h"},{"path":"/usr/include/sys/time.h"},{"path":"/usr/include/sys/timeb.h"},{"path":"/usr/include/sys/timerfd.h"},{"path":"/usr/include/sys/times.h"},{"path":"/usr/include/sys/timex.h"},{"path":"/usr/include/sys/ttydefaults.h"},{"path":"/usr/include/sys/types.h"},{"path":"/usr/include/sys/ucontext.h"},{"path":"/usr/include/sys/uio.h"},{"path":"/usr/include/sys/un.h"},{"path":"/usr/include/sys/user.h"},{"path":"/usr/include/sys/utsname.h"},{"path":"/usr/include/sys/vfs.h"},{"path":"/usr/include/sys/vt.h"},{"path":"/usr/include/sys/wait.h"},{"path":"/usr/include/sys/xattr.h"},{"path":"/usr/lib"},{"path":"/usr/lib/Scrt1.o"},{"path":"/usr/lib/crt1.o"},{"path":"/usr/lib/crti.o"},{"path":"/usr/lib/crtn.o"},{"path":"/usr/lib/libc.a"},{"path":"/usr/lib/libc.so"},{"path":"/usr/lib/libcrypt.a"},{"path":"/usr/lib/libdl.a"},{"path":"/usr/lib/libm.a"},{"path":"/usr/lib/libpthread.a"},{"path":"/usr/lib/libresolv.a"},{"path":"/usr/lib/librt.a"},{"path":"/usr/lib/libssp_nonshared.a"},{"path":"/usr/lib/libutil.a"},{"path":"/usr/lib/libxnet.a"},{"path":"/usr/lib/rcrt1.o"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.6-r6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107891","versionConstraint":"< 1.2.6-r6 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"musl","version":"1.2.6-r3"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107891","fix":{"state":"fixed","versions":["1.2.6-r6"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"1.2.6-r6"}]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107891","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107891","date":"2026-11-12","epss":0.00549,"percentile":0.46443}],"risk":0.42822,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107891"},"relatedVulnerabilities":[{"id":"CVE-2026-107891","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107891","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107891","date":"2026-11-12","epss":0.00549,"percentile":0.46443}],"urls":["https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941","https://musl.libc.org","https://www.openwall.com/lists/musl/2026/10/21/1","http://www.openwall.com/lists/oss-security/2026/10/21/18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107891","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-12","epss":0.00556,"percentile":0.46868}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-12","epss":0.00433,"percentile":0.38038}],"risk":0.391865,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-12","epss":0.00433,"percentile":0.38038}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-12","epss":0.00433,"percentile":0.38038}],"risk":0.391865,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-12","epss":0.00433,"percentile":0.38038}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"risk":0.3705,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"risk":0.3628799999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-115506"},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"risk":0.31875000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-117610"},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-18","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-12","epss":0.00419,"percentile":0.36732}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"risk":0.30693499999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-118370"},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"193eb40fb65beba6","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"1.3.2-r1","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-4738","fix":{"state":"fixed","versions":["1.4-r0"],"available":[{"date":"2026-11-06","kind":"first-observed","version":"1.4-r0"}]},"cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"risk":0.24748,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4738"},"relatedVulnerabilities":[{"id":"CVE-2026-4738","cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"urls":["https://github.com/OSGeo/gdal/pull/12244"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4738","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0."}]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69649","versionConstraint":"<= 2.46 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69649","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69649","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69649","date":"2026-11-12","epss":0.00308,"percentile":0.2395}],"risk":0.21559999999999999,"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33697","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=66a3492ce68e1ae45b2489bd9a815c39ea5d7f66"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69649","description":"GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-3442","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-3442","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3442","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3442","date":"2026-11-12","epss":0.00291,"percentile":0.219}],"risk":0.20515499999999998,"urls":["https://access.redhat.com/errata/RHSA-2026:33527","https://access.redhat.com/errata/RHSA-2026:39022","https://access.redhat.com/security/cve/CVE-2026-3442","https://bugzilla.redhat.com/show_bug.cgi?id=2443828"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3442","description":"A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an application level denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"ec896a529e555d4d","cpes":["cpe:2.3:a:busybox:busybox:1.38.0-r7:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38754","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38754","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38754","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-38754","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38754","date":"2026-11-12","epss":0.00235,"percentile":0.14625}],"risk":0.16215,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092353.html","https://lists.busybox.net/pipermail/busybox/2026-June/092360.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38754","description":"A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[]},{"artifact":{"id":"af4246bdca240aec","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=busybox","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38754","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38754","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38754","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-38754","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38754","date":"2026-11-12","epss":0.00235,"percentile":0.14625}],"risk":0.16215,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092353.html","https://lists.busybox.net/pipermail/busybox/2026-June/092360.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38754","description":"A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[]},{"artifact":{"id":"66957269e564035e","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.38.0-r7:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=busybox","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38754","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38754","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38754","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-38754","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38754","date":"2026-11-12","epss":0.00235,"percentile":0.14625}],"risk":0.16215,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092353.html","https://lists.busybox.net/pipermail/busybox/2026-June/092360.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38754","description":"A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-3441","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-3441","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3441","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3441","date":"2026-11-12","epss":0.00209,"percentile":0.1121}],"risk":0.14734499999999998,"urls":["https://access.redhat.com/errata/RHSA-2026:33527","https://access.redhat.com/errata/RHSA-2026:39022","https://access.redhat.com/security/cve/CVE-2026-3441","https://bugzilla.redhat.com/show_bug.cgi?id=2443826"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3441","description":"A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69651","versionConstraint":"<= 2.46 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69651","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69651","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69651","date":"2026-11-12","epss":0.00274,"percentile":0.20025}],"risk":0.14384999999999998,"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33698","https://sourceware.org/bugzilla/show_bug.cgi?id=33700","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=81e90cf63a10ad11772c2437c8f2a88f1a00c739","https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=ea4bc025abdba85a90e26e13f551c16a44bfa92","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69651","description":"GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version."},"relatedVulnerabilities":[]},{"artifact":{"id":"ec896a529e555d4d","cpes":["cpe:2.3:a:busybox:busybox:1.38.0-r7:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38755","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38755","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38755","cwe":"CWE-674","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-38755","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38755","date":"2026-11-12","epss":0.00207,"percentile":0.10906}],"risk":0.131445,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092354.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38755","description":"A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[]},{"artifact":{"id":"af4246bdca240aec","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=busybox","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38755","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38755","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38755","cwe":"CWE-674","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-38755","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38755","date":"2026-11-12","epss":0.00207,"percentile":0.10906}],"risk":0.131445,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092354.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38755","description":"A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[]},{"artifact":{"id":"66957269e564035e","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.38.0-r7:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=busybox","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38755","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38755","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38755","cwe":"CWE-674","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-38755","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38755","date":"2026-11-12","epss":0.00207,"percentile":0.10906}],"risk":0.131445,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092354.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38755","description":"A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6846","versionConstraint":"<= 2.46 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6846","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6846","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-6846","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6846","date":"2026-11-12","epss":0.00171,"percentile":0.06554}],"risk":0.130815,"urls":["https://access.redhat.com/errata/RHSA-2026:33527","https://access.redhat.com/errata/RHSA-2026:39022","https://access.redhat.com/security/cve/CVE-2026-6846","https://bugzilla.redhat.com/show_bug.cgi?id=2460006","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6846.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6846","description":"A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69652","versionConstraint":"<= 2.46 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69652","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69652","cwe":"CWE-460","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69652","date":"2026-11-12","epss":0.00202,"percentile":0.10269}],"risk":0.11312000000000001,"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33701","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=44b79abd0fa12e7947252eb4c6e5d16ed6033e01"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69652","description":"GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69648","versionConstraint":"<= 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69648","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69648","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69648","date":"2026-11-12","epss":0.00202,"percentile":0.10244}],"risk":0.11312000000000001,"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33641","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69648","description":"GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed."},"relatedVulnerabilities":[]},{"artifact":{"id":"7cca763a2d34f1bd","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-95692"},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"5e69f5fbd6b3b30f","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-95692"},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69647","versionConstraint":"<= 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69647","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69647","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69647","date":"2026-11-12","epss":0.00178,"percentile":0.07468}],"risk":0.09967999999999999,"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33640","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69647","description":"GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis."},"relatedVulnerabilities":[]},{"artifact":{"id":"ec896a529e555d4d","cpes":["cpe:2.3:a:busybox:busybox:1.38.0-r7:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38753","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38753","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38753","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-38753","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38753","date":"2026-11-12","epss":0.00145,"percentile":0.0385}],"risk":0.099325,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092352.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38753","description":"A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script."},"relatedVulnerabilities":[]},{"artifact":{"id":"af4246bdca240aec","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.38.0-r7:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=busybox","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38753","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38753","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38753","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-38753","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38753","date":"2026-11-12","epss":0.00145,"percentile":0.0385}],"risk":0.099325,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092352.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38753","description":"A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script."},"relatedVulnerabilities":[]},{"artifact":{"id":"66957269e564035e","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.38.0-r7:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.38.0-r7:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.38.0-r7?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=busybox","type":"apk","version":"1.38.0-r7","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-38753","versionConstraint":"= 1.38.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.38.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.38.0-r7"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-38753","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38753","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-38753","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38753","date":"2026-11-12","epss":0.00145,"percentile":0.0385}],"risk":0.099325,"urls":["https://busybox.net","https://lists.busybox.net/pipermail/busybox/2026-June/092352.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38753","description":"A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-4647","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-4647","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4647","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4647","date":"2026-11-12","epss":0.00175,"percentile":0.07025}],"risk":0.09712499999999999,"urls":["https://access.redhat.com/errata/RHSA-2026:33527","https://access.redhat.com/errata/RHSA-2026:39022","https://access.redhat.com/security/cve/CVE-2026-4647","https://bugzilla.redhat.com/show_bug.cgi?id=2450302","https://sourceware.org/bugzilla/show_bug.cgi?id=33919"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4647","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks."},"relatedVulnerabilities":[]},{"artifact":{"id":"7cca763a2d34f1bd","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-88822"},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"5e69f5fbd6b3b30f","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-88822"},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"7cca763a2d34f1bd","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-95691"},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"5e69f5fbd6b3b30f","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-95691"},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6845","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6845","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6845","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6845","date":"2026-11-12","epss":0.00147,"percentile":0.03962}],"risk":0.0735,"urls":["https://access.redhat.com/errata/RHSA-2026:34924","https://access.redhat.com/errata/RHSA-2026:39022","https://access.redhat.com/security/cve/CVE-2026-6845","https://bugzilla.redhat.com/show_bug.cgi?id=2460012"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6845","description":"A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69644","versionConstraint":"< 2.46 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69644","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69644","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69644","date":"2026-11-12","epss":0.00144,"percentile":0.03729}],"risk":0.07200000000000001,"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33639","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69644","description":"An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file."},"relatedVulnerabilities":[]},{"artifact":{"id":"7cca763a2d34f1bd","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-88823"},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"5e69f5fbd6b3b30f","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-88823"},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"7cca763a2d34f1bd","cpes":["cpe:2.3:a:libcrypto3:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto3:libcrypto:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libcrypto3","purl":"pkg:apk/alpine/libcrypto3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/private"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.3"},{"path":"/usr/lib/engines-3"},{"path":"/usr/lib/engines-3/afalg.so"},{"path":"/usr/lib/engines-3/capi.so"},{"path":"/usr/lib/engines-3/loader_attic.so"},{"path":"/usr/lib/engines-3/padlock.so"},{"path":"/usr/lib/ossl-modules"},{"path":"/usr/lib/ossl-modules/legacy.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107496"},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"5e69f5fbd6b3b30f","cpes":["cpe:2.3:a:libssl3:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl3:libssl:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl3:3.5.9-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:3.5.9-r0:*:*:*:*:*:*:*"],"name":"libssl3","purl":"pkg:apk/alpine/libssl3@3.5.9-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=openssl","type":"apk","version":"3.5.9-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.9-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"< 3.5.9-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"openssl","version":"3.5.9-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"fixed","versions":["3.5.9-r1"],"available":[{"date":"2026-11-12","kind":"first-observed","version":"3.5.9-r1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107496"},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"79df260bda282101","cpes":["cpe:2.3:a:patch:patch:2.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:patch:2.8-r0:*:*:*:*:*:*:*"],"name":"patch","purl":"pkg:apk/alpine/patch@2.8-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.8-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/patch"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"patch"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.8.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56288","versionConstraint":"< 2.8.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"patch","version":"2.8-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.8.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56288","versionConstraint":"< 2.8.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"patch","version":"2.8-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-56288","fix":{"state":"fixed","versions":["2.8.1-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"2.8.1-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56288","cwe":"CWE-476","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56288","date":"2026-11-12","epss":0.00115,"percentile":0.01558}],"risk":0.060375,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-56288"},"relatedVulnerabilities":[{"id":"CVE-2026-56288","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56288","cwe":"CWE-476","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56288","date":"2026-11-12","epss":0.00115,"percentile":0.01558}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56288","https://cgit.git.savannah.gnu.org/cgit/patch.git/","https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56288","description":"GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.\nAn attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.\n\n\n\nThis issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313"}]},{"artifact":{"id":"79df260bda282101","cpes":["cpe:2.3:a:patch:patch:2.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:patch:2.8-r0:*:*:*:*:*:*:*"],"name":"patch","purl":"pkg:apk/alpine/patch@2.8-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.8-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/patch"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"patch"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.8.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56289","versionConstraint":"< 2.8.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"patch","version":"2.8-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.8.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56289","versionConstraint":"< 2.8.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"patch","version":"2.8-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-56289","fix":{"state":"fixed","versions":["2.8.1-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"2.8.1-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56289","cwe":"CWE-835","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56289","date":"2026-11-12","epss":0.00115,"percentile":0.01558}],"risk":0.060375,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-56289"},"relatedVulnerabilities":[{"id":"CVE-2026-56289","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56289","cwe":"CWE-835","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56289","date":"2026-11-12","epss":0.00115,"percentile":0.01558}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56288","https://cgit.git.savannah.gnu.org/cgit/patch.git/","https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56289","description":"GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position.\nThis results in excessive CPU consumption and prevents the process from completing.\nAn attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.\n\n\n\nThis issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100407","versionConstraint":">= 2.44.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100407","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100407","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100407","date":"2026-11-12","epss":0.00117,"percentile":0.01667}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100407","description":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100408","versionConstraint":">= 2.43.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100408","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100408","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100408","date":"2026-11-12","epss":0.00117,"percentile":0.01667}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100408","description":"Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"56144b5ac3e92bcb","cpes":["cpe:2.3:a:binutils:binutils:2.45.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:gnu:binutils:2.45.1-r1:*:*:*:*:*:*:*"],"name":"binutils","purl":"pkg:apk/alpine/binutils@2.45.1-r1?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.45.1-r1","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/addr2line"},{"path":"/usr/bin/ar"},{"path":"/usr/bin/as"},{"path":"/usr/bin/c++filt"},{"path":"/usr/bin/dwp"},{"path":"/usr/bin/elfedit"},{"path":"/usr/bin/gprof"},{"path":"/usr/bin/ld"},{"path":"/usr/bin/ld.bfd"},{"path":"/usr/bin/nm"},{"path":"/usr/bin/objcopy"},{"path":"/usr/bin/objdump"},{"path":"/usr/bin/ranlib"},{"path":"/usr/bin/readelf"},{"path":"/usr/bin/size"},{"path":"/usr/bin/strings"},{"path":"/usr/bin/strip"},{"path":"/usr/lib"},{"path":"/usr/lib/libbfd-2.45.1.so"},{"path":"/usr/lib/libctf-nobfd.so.0"},{"path":"/usr/lib/libctf-nobfd.so.0.0.0"},{"path":"/usr/lib/libctf.so.0"},{"path":"/usr/lib/libctf.so.0.0.0"},{"path":"/usr/lib/libopcodes-2.45.1.so"},{"path":"/usr/lib/libsframe.so.2"},{"path":"/usr/lib/libsframe.so.2.0.0"},{"path":"/usr/lib/bfd-plugins"},{"path":"/usr/lib/bfd-plugins/libdep.so"},{"path":"/usr/x86_64-alpine-linux-musl"},{"path":"/usr/x86_64-alpine-linux-musl/bin"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ar"},{"path":"/usr/x86_64-alpine-linux-musl/bin/as"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ld.bfd"},{"path":"/usr/x86_64-alpine-linux-musl/bin/nm"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objcopy"},{"path":"/usr/x86_64-alpine-linux-musl/bin/objdump"},{"path":"/usr/x86_64-alpine-linux-musl/bin/ranlib"},{"path":"/usr/x86_64-alpine-linux-musl/bin/readelf"},{"path":"/usr/x86_64-alpine-linux-musl/bin/strip"},{"path":"/usr/x86_64-alpine-linux-musl/lib"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf32_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_i386.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_iamcu.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xd"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdcer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xde"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xder"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xdwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xs"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsc"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsce"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xscer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xse"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xser"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xsw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xswer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xw"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/elf_x86_64.xwer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pe.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.x"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xa"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xbn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xe"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xer"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xn"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xr"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/i386pep.xu"},{"path":"/usr/x86_64-alpine-linux-musl/lib/ldscripts/stamp"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"binutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6844","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:binutils:2.45.1:*:*:*:*:*:*:*"],"package":{"name":"binutils","version":"2.45.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6844","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6844","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6844","date":"2026-11-12","epss":0.00104,"percentile":0.0102}],"risk":0.054599999999999996,"urls":["https://access.redhat.com/security/cve/CVE-2026-6844","https://bugzilla.redhat.com/show_bug.cgi?id=2460016"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6844","description":"A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}},{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.25.0_alpha20260805&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:66fd2f09cef9a9947cabd672e21ddd2b61344578754d2051b65d71d235327dda","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.56.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.56.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.25.0_alpha20260805"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:edge"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.56.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.56.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:edge","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T01:21:06.300Z","grype_db_version":"2026-11-13T15:40:34.000Z"}