{"grype_matches":[{"artifact":{"id":"22ea4848d40d3bd4","cpes":["cpe:2.3:a:golang:networking:v0.61.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.61.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.61.0","type":"go-module","version":"v0.61.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=","mainModule":"github.com/AdguardTeam/AdGuardHome","architecture":"amd64","goCompiledVersion":"go1.27.3"},"locations":[{"path":"/opt/adguardhome/AdGuardHome","layerID":"sha256:589100244e73b5f71960f169f7ea1c05a473a4dfe29fbdb91cf91f9b2992dbc0","accessPath":"/opt/adguardhome/AdGuardHome","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.62.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.61.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6860","fix":{"state":"fixed","versions":["0.62.0"],"available":[{"date":"2026-10-27","kind":"release","version":"0.62.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78661","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78661","date":"2026-11-12","epss":0.00409,"percentile":0.35646}],"risk":0.30674999999999997,"urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/849365","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse."},"relatedVulnerabilities":[{"id":"CVE-2026-78661","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78661","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78661","date":"2026-11-12","epss":0.00409,"percentile":0.35646}],"urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse."}]},{"artifact":{"id":"8b86c6721d436c9f","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=alpine-3.23.7","type":"apk","version":"1.3.2-r1","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:3ce0fdd40735c0ef7e3470975f0776cd20b7e6b6dc68e7214b16d31bd73d4467","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.23.7"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.23"}},{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.23.7"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.23"}}],"vulnerability":{"id":"CVE-2026-4738","fix":{"state":"fixed","versions":["1.4-r0"],"available":[{"date":"2026-11-07","kind":"first-observed","version":"1.4-r0"}]},"cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"risk":0.24748,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.23","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4738"},"relatedVulnerabilities":[{"id":"CVE-2026-4738","cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"urls":["https://github.com/OSGeo/gdal/pull/12244"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4738","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0."}]},{"artifact":{"id":"5b8a9495e4efe754","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r30:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r30?arch=x86_64&distro=alpine-3.23.7","type":"apk","version":"1.37.0-r30","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:3ce0fdd40735c0ef7e3470975f0776cd20b7e6b6dc68e7214b16d31bd73d4467","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r30"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"3e88c98a595f91bf","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r30:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r30?arch=x86_64&distro=alpine-3.23.7&upstream=busybox","type":"apk","version":"1.37.0-r30","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:3ce0fdd40735c0ef7e3470975f0776cd20b7e6b6dc68e7214b16d31bd73d4467","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r30"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"70e62fc46b7f6a24","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r30:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r30?arch=x86_64&distro=alpine-3.23.7&upstream=busybox","type":"apk","version":"1.37.0-r30","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:3ce0fdd40735c0ef7e3470975f0776cd20b7e6b6dc68e7214b16d31bd73d4467","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r30"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"22ea4848d40d3bd4","cpes":["cpe:2.3:a:golang:networking:v0.61.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.61.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.61.0","type":"go-module","version":"v0.61.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=","mainModule":"github.com/AdguardTeam/AdGuardHome","architecture":"amd64","goCompiledVersion":"go1.27.3"},"locations":[{"path":"/opt/adguardhome/AdGuardHome","layerID":"sha256:589100244e73b5f71960f169f7ea1c05a473a4dfe29fbdb91cf91f9b2992dbc0","accessPath":"/opt/adguardhome/AdGuardHome","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.62.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.61.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6866","fix":{"state":"fixed","versions":["0.62.0"],"available":[{"date":"2026-10-27","kind":"release","version":"0.62.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97045","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97045","date":"2026-11-12","epss":0.00267,"percentile":0.19047}],"risk":0.14818499999999998,"urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/855121","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text."},"relatedVulnerabilities":[{"id":"CVE-2026-97045","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97045","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97045","date":"2026-11-12","epss":0.00267,"percentile":0.19047}],"urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text."}]},{"artifact":{"id":"a3e40db396d92bfd","cpes":["cpe:2.3:a:golang:go:1.27.3:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.3","type":"go-module","version":"go1.27.3","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.3"},"locations":[{"path":"/opt/adguardhome/AdGuardHome","layerID":"sha256:589100244e73b5f71960f169f7ea1c05a473a4dfe29fbdb91cf91f9b2992dbc0","accessPath":"/opt/adguardhome/AdGuardHome","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6859","versionConstraint":"<1.26.11||>=1.27.0-0,<1.27.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.3"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6859","fix":{"state":"fixed","versions":["1.26.11","1.27.4"],"available":[{"date":"2026-11-10","kind":"release","version":"1.26.11"},{"date":"2026-11-10","kind":"release","version":"1.27.4"}]},"cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"risk":0.08549999999999999,"urls":["https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/862185","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."},"relatedVulnerabilities":[{"id":"CVE-2026-97054","cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"urls":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97054","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."}]},{"artifact":{"id":"c0ae52378e3a01cd","cpes":["cpe:2.3:a:golang:crypto:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.58.0:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.58.0","type":"go-module","version":"v0.58.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=","mainModule":"github.com/AdguardTeam/AdGuardHome","architecture":"amd64","goCompiledVersion":"go1.27.3"},"locations":[{"path":"/opt/adguardhome/AdGuardHome","layerID":"sha256:589100244e73b5f71960f169f7ea1c05a473a4dfe29fbdb91cf91f9b2992dbc0","accessPath":"/opt/adguardhome/AdGuardHome","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.58.1-0.20261009181718-2f1f834330b2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"<0.58.1-0.20261009181718-2f1f834330b2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.58.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5932","fix":{"state":"fixed","versions":["0.58.1-0.20261009181718-2f1f834330b2"],"available":[{"date":"2026-10-09","kind":"release","version":"0.58.1-0.20261009181718-2f1f834330b2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81227"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/44226","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."},"relatedVulnerabilities":[]}],"grade":"C","score":"69.00","as_of":"2026-11-14T08:34:59.829Z","grype_db_version":"2026-11-13T15:40:34.000Z"}