{"grype_matches":[{"artifact":{"id":"b4a7ac3030f5506b","cpes":["cpe:2.3:a:gcc-13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"gcc-13","purl":"pkg:deb/ubuntu/gcc-13@13.3.0-6ubuntu2~24.04.1?distro=ubuntu","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":[],"locations":[{"path":"/usr/bin/x86_64-linux-gnu-gcc-13","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/bin/x86_64-linux-gnu-gcc-13","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"b4a7ac3030f5506b","cpes":["cpe:2.3:a:gcc-13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"gcc-13","purl":"pkg:deb/ubuntu/gcc-13@13.3.0-6ubuntu2~24.04.1?distro=ubuntu","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":[],"locations":[{"path":"/usr/bin/x86_64-linux-gnu-gcc-13","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/bin/x86_64-linux-gnu-gcc-13","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.21450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"b4a7ac3030f5506b","cpes":["cpe:2.3:a:gcc-13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"gcc-13","purl":"pkg:deb/ubuntu/gcc-13@13.3.0-6ubuntu2~24.04.1?distro=ubuntu","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":[],"locations":[{"path":"/usr/bin/x86_64-linux-gnu-gcc-13","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/bin/x86_64-linux-gnu-gcc-13","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"b4a7ac3030f5506b","cpes":["cpe:2.3:a:gcc-13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"gcc-13","purl":"pkg:deb/ubuntu/gcc-13@13.3.0-6ubuntu2~24.04.1?distro=ubuntu","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":[],"locations":[{"path":"/usr/bin/x86_64-linux-gnu-gcc-13","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/bin/x86_64-linux-gnu-gcc-13","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"risk":0.1565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115456"},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-12","epss":0.00313,"percentile":0.24554}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"b4a7ac3030f5506b","cpes":["cpe:2.3:a:gcc-13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"gcc-13","purl":"pkg:deb/ubuntu/gcc-13@13.3.0-6ubuntu2~24.04.1?distro=ubuntu","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":[],"locations":[{"path":"/usr/bin/x86_64-linux-gnu-gcc-13","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/bin/x86_64-linux-gnu-gcc-13","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-125709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"risk":0.10200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-125709"},"relatedVulnerabilities":[{"id":"CVE-2026-125709","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125709","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-125709","date":"2026-11-12","epss":0.00204,"percentile":0.10518}],"urls":["https://access.redhat.com/security/cve/CVE-2026-125709","https://bugzilla.redhat.com/show_bug.cgi?id=2569390"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125709","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption."}]},{"artifact":{"id":"f19767660d7ddb63","cpes":["cpe:2.3:a:golang:go:1.27.3:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.3","type":"go-module","version":"go1.27.3","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.3"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6859","versionConstraint":"<1.26.11||>=1.27.0-0,<1.27.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.3"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6859","fix":{"state":"fixed","versions":["1.26.11","1.27.4"],"available":[{"date":"2026-11-10","kind":"release","version":"1.26.11"},{"date":"2026-11-10","kind":"release","version":"1.27.4"}]},"cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"risk":0.08549999999999999,"urls":["https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/862185","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."},"relatedVulnerabilities":[{"id":"CVE-2026-97054","cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"urls":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97054","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."}]},{"artifact":{"id":"b4a7ac3030f5506b","cpes":["cpe:2.3:a:gcc-13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"gcc-13","purl":"pkg:deb/ubuntu/gcc-13@13.3.0-6ubuntu2~24.04.1?distro=ubuntu","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":[],"locations":[{"path":"/usr/bin/x86_64-linux-gnu-gcc-13","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/bin/x86_64-linux-gnu-gcc-13","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/cc1","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/collect2","annotations":{"evidence":"primary"}},{"path":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/libexec/gcc/x86_64-linux-gnu/13/liblto_plugin.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"risk":0.066,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114690"},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-12","epss":0.00132,"percentile":0.02815}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"ecd6a81c4ff8fb1f","cpes":["cpe:2.3:a:systemd:systemd:255.4-1ubuntu8.18:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:deb/Ubuntu/systemd@255.4-1ubuntu8.18?distro=Ubuntu","type":"deb","version":"255.4-1ubuntu8.18","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsystemd.so.0.38.0","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/lib/x86_64-linux-gnu/libsystemd.so.0.38.0","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libudev.so.1.7.8","layerID":"sha256:1cf99da3913478538f78fb9f33ff617fd5792866cab0ee2d33ef826c61f168af","accessPath":"/usr/lib/x86_64-linux-gnu/libudev.so.1.7.8","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"systemd","version":"255.4-1ubuntu8.18"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"risk":0.054,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-40228"},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]}],"grade":"A","score":"100.00","as_of":"2026-11-14T07:57:10.318Z","grype_db_version":"2026-11-13T15:40:34.000Z"}