{"grype_matches":[{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-10","epss":0.01284,"percentile":0.70351}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-10","epss":0.01284,"percentile":0.70351}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-10","epss":0.01284,"percentile":0.70351}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-10","epss":0.01284,"percentile":0.70351}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-10","epss":0.01166,"percentile":0.67579}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-10","epss":0.01166,"percentile":0.67579}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-10","epss":0.01166,"percentile":0.67579}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-10","epss":0.01166,"percentile":0.67579}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-10","epss":0.01096,"percentile":0.65858}],"risk":0.8548800000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-10","epss":0.01096,"percentile":0.65858}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-10","epss":0.01096,"percentile":0.65858}],"risk":0.8548800000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-10","epss":0.01096,"percentile":0.65858}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-10","epss":0.01045,"percentile":0.64436}],"risk":0.8151,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-10","epss":0.01045,"percentile":0.64436}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-10","epss":0.01045,"percentile":0.64436}],"risk":0.8151,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-10","epss":0.01045,"percentile":0.64436}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-10","epss":0.00995,"percentile":0.62961}],"risk":0.7761,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-10","epss":0.00995,"percentile":0.62961}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-10","epss":0.00995,"percentile":0.62961}],"risk":0.7761,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-10","epss":0.00995,"percentile":0.62961}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-10","epss":0.00776,"percentile":0.56109}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-10","epss":0.00776,"percentile":0.56109}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-10","epss":0.00776,"percentile":0.56109}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-10","epss":0.00776,"percentile":0.56109}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-10","epss":0.00731,"percentile":0.54623}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-10","epss":0.00731,"percentile":0.54623}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-10","epss":0.00731,"percentile":0.54623}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-10","epss":0.00731,"percentile":0.54623}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-10","epss":0.00828,"percentile":0.57819}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-10","epss":0.00699,"percentile":0.53475}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-10","epss":0.00699,"percentile":0.53475}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-10","epss":0.00699,"percentile":0.53475}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-10","epss":0.00699,"percentile":0.53475}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-10","epss":0.00676,"percentile":0.52576}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-10","epss":0.00766,"percentile":0.55805}],"risk":0.59748,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-10","epss":0.00766,"percentile":0.55805}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-10","epss":0.00766,"percentile":0.55805}],"risk":0.59748,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-10","epss":0.00766,"percentile":0.55805}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-10","epss":0.00721,"percentile":0.54268}],"risk":0.56238,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-10","epss":0.00721,"percentile":0.54268}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-10","epss":0.00721,"percentile":0.54268}],"risk":0.56238,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-10","epss":0.00721,"percentile":0.54268}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-10","epss":0.00705,"percentile":0.53681}],"risk":0.5499,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-10","epss":0.00705,"percentile":0.53681}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-10","epss":0.00705,"percentile":0.53681}],"risk":0.5499,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-10","epss":0.00705,"percentile":0.53681}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-10","epss":0.00667,"percentile":0.52207}],"risk":0.52026,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-10","epss":0.00667,"percentile":0.52207}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-10","epss":0.00667,"percentile":0.52207}],"risk":0.52026,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-10","epss":0.00667,"percentile":0.52207}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"891f174ca90db8d5","cpes":["cpe:2.3:a:gnome:glib:2.88.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:glib:glib:2.88.1-r1:*:*:*:*:*:*:*"],"name":"glib","purl":"pkg:apk/alpine/glib@2.88.1-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.88.1-r1","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gapplication"},{"path":"/usr/bin/gdbus"},{"path":"/usr/bin/gi-compile-repository"},{"path":"/usr/bin/gi-decompile-typelib"},{"path":"/usr/bin/gi-inspect-typelib"},{"path":"/usr/bin/gio"},{"path":"/usr/bin/gio-querymodules"},{"path":"/usr/bin/glib-compile-schemas"},{"path":"/usr/bin/gsettings"},{"path":"/usr/lib"},{"path":"/usr/lib/libgio-2.0.so.0"},{"path":"/usr/lib/libgio-2.0.so.0.8800.1"},{"path":"/usr/lib/libgirepository-2.0.so.0"},{"path":"/usr/lib/libgirepository-2.0.so.0.8800.1"},{"path":"/usr/lib/libglib-2.0.so.0"},{"path":"/usr/lib/libglib-2.0.so.0.8800.1"},{"path":"/usr/lib/libgmodule-2.0.so.0"},{"path":"/usr/lib/libgmodule-2.0.so.0.8800.1"},{"path":"/usr/lib/libgobject-2.0.so.0"},{"path":"/usr/lib/libgobject-2.0.so.0.8800.1"},{"path":"/usr/lib/libgthread-2.0.so.0"},{"path":"/usr/lib/libgthread-2.0.so.0.8800.1"},{"path":"/usr/lib/gio"},{"path":"/usr/lib/gio/modules"},{"path":"/usr/lib/girepository-1.0"},{"path":"/usr/lib/girepository-1.0/GIRepository-3.0.typelib"},{"path":"/usr/lib/girepository-1.0/GLib-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GLibUnix-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GModule-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GObject-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/Gio-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GioUnix-2.0.typelib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/gio-launch-desktop"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-58016","versionConstraint":"< 2.89.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnome:glib:2.88.1:*:*:*:*:*:*:*"],"package":{"name":"glib","version":"2.88.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-58016","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58016","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-58016","date":"2026-11-10","epss":0.0056,"percentile":0.46925}],"risk":0.4844,"urls":["https://access.redhat.com/errata/RHSA-2026:42063","https://access.redhat.com/errata/RHSA-2026:42089","https://access.redhat.com/errata/RHSA-2026:42090","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:49512","https://access.redhat.com/errata/RHSA-2026:51175","https://access.redhat.com/errata/RHSA-2026:51176","https://access.redhat.com/errata/RHSA-2026:51177","https://access.redhat.com/errata/RHSA-2026:51181","https://access.redhat.com/errata/RHSA-2026:51182","https://access.redhat.com/errata/RHSA-2026:51183","https://access.redhat.com/errata/RHSA-2026:51184","https://access.redhat.com/errata/RHSA-2026:51185","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72394","https://access.redhat.com/errata/RHSA-2026:72395","https://access.redhat.com/errata/RHSA-2026:72399","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82336","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:97163","https://access.redhat.com/security/cve/CVE-2026-58016","https://bugzilla.redhat.com/show_bug.cgi?id=2492257","https://gitlab.gnome.org/GNOME/glib/-/issues/3932"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58016","description":"A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-10","epss":0.0051,"percentile":0.43816}],"risk":0.46155000000000007,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-10","epss":0.0051,"percentile":0.43816}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-10","epss":0.0051,"percentile":0.43816}],"risk":0.46155000000000007,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-10","epss":0.0051,"percentile":0.43816}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-10","epss":0.00604,"percentile":0.49267}],"risk":0.44998,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-10","epss":0.00604,"percentile":0.49267}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-10","epss":0.00604,"percentile":0.49267}],"risk":0.44998,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-10","epss":0.00604,"percentile":0.49267}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-10","epss":0.00589,"percentile":0.48511}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-10","epss":0.00589,"percentile":0.48511}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-10","epss":0.00589,"percentile":0.48511}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-10","epss":0.00589,"percentile":0.48511}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-10","epss":0.00556,"percentile":0.46702}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-10","epss":0.00556,"percentile":0.46702}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-10","epss":0.00556,"percentile":0.46702}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-10","epss":0.00556,"percentile":0.46702}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-10","epss":0.00433,"percentile":0.37876}],"risk":0.391865,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-10","epss":0.00433,"percentile":0.37876}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-10","epss":0.00433,"percentile":0.37876}],"risk":0.391865,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-10","epss":0.00433,"percentile":0.37876}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-10","epss":0.00494,"percentile":0.42743}],"risk":0.3705,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-10","epss":0.00494,"percentile":0.42743}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-10","epss":0.00448,"percentile":0.39264}],"risk":0.3628799999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-115506"},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-10","epss":0.00448,"percentile":0.39264}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-10","epss":0.00425,"percentile":0.37138}],"risk":0.31875000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-117610"},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-10","epss":0.00425,"percentile":0.37138}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-10","epss":0.00419,"percentile":0.36575}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-10","epss":0.00419,"percentile":0.36575}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-10","epss":0.00419,"percentile":0.36575}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-10","epss":0.00419,"percentile":0.36575}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-10","epss":0.00391,"percentile":0.33566}],"risk":0.30693499999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-118370"},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-10","epss":0.00391,"percentile":0.33566}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"193eb40fb65beba6","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.3.2-r1","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-4738","fix":{"state":"fixed","versions":["1.4-r0"],"available":[{"date":"2026-11-07","kind":"first-observed","version":"1.4-r0"}]},"cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-10","epss":0.00269,"percentile":0.19183}],"risk":0.24748,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4738"},"relatedVulnerabilities":[{"id":"CVE-2026-4738","cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-10","epss":0.00269,"percentile":0.19183}],"urls":["https://github.com/OSGeo/gdal/pull/12244"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4738","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0."}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-10","epss":0.00428,"percentile":0.37367}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-10","epss":0.00428,"percentile":0.37367}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-10","epss":0.00428,"percentile":0.37367}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-10","epss":0.00428,"percentile":0.37367}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-10","epss":0.00312,"percentile":0.24326}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-10","epss":0.00312,"percentile":0.24326}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-10","epss":0.00312,"percentile":0.24326}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-10","epss":0.00186,"percentile":0.08287}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-10","epss":0.00186,"percentile":0.08287}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-10","epss":0.00186,"percentile":0.08287}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-10","epss":0.00186,"percentile":0.08287}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-10","epss":0.00131,"percentile":0.02743}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-10","epss":0.00131,"percentile":0.02743}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-10","epss":0.00131,"percentile":0.02743}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-10","epss":0.00131,"percentile":0.02743}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:f30cdf8467915271db3826f763f76ff1b4ac62678ca903bfdbc9a55961f7c80a","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-12T01:41:57.335Z","grype_db_version":"2026-11-11T06:21:32.000Z"}