{"id":"CVE-2025-27144","aliases":["ALSA-2025:19566","ALSA-2025:7389","ALSA-2025:7397","ALSA-2025:7459","ALSA-2025:7462","ALSA-2025:7467","AZL-57096","AZL-57099","AZL-57102","AZL-57105","AZL-57108","AZL-57111","AZL-57114","AZL-57117","AZL-57120","AZL-57123","AZL-57126","AZL-57129","AZL-57132","AZL-57135","AZL-57138","AZL-57144","AZL-57147","AZL-57153","AZL-57162","AZL-57165","AZL-57168","AZL-57171","AZL-57174","AZL-57177","AZL-57180","AZL-57183","AZL-57186","AZL-57192","AZL-57195","AZL-57198","AZL-57201","CLSA-2025-1752088672","CLSA-2025-1762421840","CLSA-2025-1764152728","CLSA-2025-1764692266","CLSA-2025-1766596893","CLSA-2026-1791280549","DEBIAN-CVE-2025-27144","EUVD-2025-4268","GHSA-c6gw-w398-hv78","GO-2025-3485","OESA-2025-2176","OESA-2025-2177","OESA-2025-2221","OESA-2025-2222","OESA-2025-2223","OESA-2025-2224","OESA-2025-2225","OESA-2025-2233","OESA-2025-2258","OESA-2025-2297","RHSA-2025:19566","RHSA-2025:19594","RHSA-2025:3061","RHSA-2025:3068","RHSA-2025:3335","RHSA-2025:3593","RHSA-2025:7389","RHSA-2025:7391","RHSA-2025:7397","RHSA-2025:7407","RHSA-2025:7459","RHSA-2025:7462","RHSA-2025:7467","RHSA-2025:7479","RLSA-2025:7389","RLSA-2025:7391","RLSA-2025:7397","RLSA-2025:7459","RLSA-2025:7462","RLSA-2025:7467","RLSA-2025:7479","UBUNTU-CVE-2025-27144","openSUSE-SU-2025:0080-1","openSUSE-SU-2025:14839-1","openSUSE-SU-2025:14840-1","openSUSE-SU-2025:14865-1","openSUSE-SU-2025:14871-1","openSUSE-SU-2025:14889-1","openSUSE-SU-2025:14909-1","openSUSE-SU-2025:14988-1","openSUSE-SU-2025:14990-1","openSUSE-SU-2025:15158-1","openSUSE-SU-2025:15304-1","openSUSE-SU-2025:15305-1","openSUSE-SU-2025:15307-1","openSUSE-SU-2025:20117-1","openSUSE-SU-2026:10230-1","openSUSE-SU-2026:12297-1","openSUSE-SU-2026:20654-1","openSUSE-SU-2026:20730-1","openSUSE-SU-2026:20798-1","openSUSE-SU-2026:21310-1","openSUSE-SU-2026:21481-1"],"aliases_more":36,"status":"published","title":"Go JOSE's Parsing Vulnerable to Denial of Service","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","severity":{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00399,"percentile":0.34611,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2025-02-24T22:22:22Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"github.com/go-jose/go-jose/v4","fixed_in":["4.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/go-jose/go-jose/v3","fixed_in":["3.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/go-jose/go-jose","fixed_in":["3.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:10","package":"osbuild-composer","fixed_in":["134.1-3.el10_0.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"osbuild-composer-core","fixed_in":["134.1-3.el10_0.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"osbuild-composer-worker","fixed_in":["134.1-3.el10_0.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"buildah","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"buildah-tests","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"skopeo","fixed_in":["2:1.18.1-1.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"skopeo-tests","fixed_in":["2:1.18.1-1.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"buildah","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"buildah-tests","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"skopeo","fixed_in":["2:1.18.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"skopeo-tests","fixed_in":["2:1.18.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"skopeo","fixed_in":["1.14.4-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"influxdb","fixed_in":["2.6.1-21"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"dcos-cli","fixed_in":["1.2.0-17"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ig","fixed_in":["0.37.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kube-vip-cloud-provider","fixed_in":["0.0.2-20"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"buildah","fixed_in":["1.41.4-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.10-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-containerd-cc","fixed_in":["1.7.7-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"podman","fixed_in":["5.6.1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"influxdb","fixed_in":["2.7.5-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerized-data-importer","fixed_in":["1.57.0-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.62.0-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"keda","fixed_in":["2.4.0-27"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerd2","fixed_in":["2.0.0-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cert-manager","fixed_in":["1.11.2-20"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerd","fixed_in":["1.7.13-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"packer","fixed_in":["1.9.5-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"keda","fixed_in":["2.14.1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"packer","fixed_in":["1.9.5-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-containerd","fixed_in":["1.6.26-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"telegraf","fixed_in":["1.29.4-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"containerized-data-importer","fixed_in":["1.55.0-23"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kubernetes","fixed_in":["1.28.4-15"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"skopeo","fixed_in":["1.14.2-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cri-o","fixed_in":["1.22.3-12"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rook","fixed_in":["1.6.2-25"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-containerd-cc","fixed_in":["1.7.7-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"dcos-cli","fixed_in":["1.2.0-20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","fixed_in":["1:1.35.4-1.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","fixed_in":["1:1.35.4-1.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer","fixed_in":["76-2.el9_2.2.alma.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-core","fixed_in":["76-2.el9_2.2.alma.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-dnf-json","fixed_in":["76-2.el9_2.2.alma.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-tests","fixed_in":["76-2.el9_2.2.alma.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-worker","fixed_in":["76-2.el9_2.2.alma.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman","fixed_in":["2:4.4.1-13.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-docker","fixed_in":["2:4.4.1-13.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-gvproxy","fixed_in":["2:4.4.1-13.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-plugins","fixed_in":["2:4.4.1-13.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-remote","fixed_in":["2:4.4.1-13.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-tests","fixed_in":["2:4.4.1-13.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana","fixed_in":["10.2.6-15.el9_6.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana-selinux","fixed_in":["10.2.6-15.el9_6.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-go-jose-go-jose","fixed_in":["4.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-jose-go-jose","fixed_in":["4.0.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"buildah","fixed_in":["1.34.1-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"buildah","fixed_in":["1.34.1-7.oe2403sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer","fixed_in":["0:134.1-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-core","fixed_in":["0:134.1-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-core-debuginfo","fixed_in":["0:134.1-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-debugsource","fixed_in":["0:134.1-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-tests-debuginfo","fixed_in":["0:134.1-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-worker","fixed_in":["0:134.1-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-worker-debuginfo","fixed_in":["0:134.1-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core-debuginfo","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debuginfo","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debugsource","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-tests-debuginfo","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker-debuginfo","fixed_in":["0:132.2-3.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-catatonit","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-catatonit-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-debugsource","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-docker","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-gvproxy","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-gvproxy-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-plugins","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-plugins-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-remote","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-remote-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-tests","fixed_in":["5:5.2.2-4.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"skopeo","fixed_in":["2:1.16.1-1.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el8","package":"skopeo-tests","fixed_in":["2:1.16.1-1.rhaos4.17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-debugsource","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-docker","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-plugins","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-plugins-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-remote","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-remote-debuginfo","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-tests","fixed_in":["5:5.2.2-4.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo","fixed_in":["2:1.16.1-1.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo-debuginfo","fixed_in":["2:1.16.1-1.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo-debugsource","fixed_in":["2:1.16.1-1.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo-tests","fixed_in":["2:1.16.1-1.rhaos4.17.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-debuginfo","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-debugsource","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-docker","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-plugins","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-plugins-debuginfo","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-remote","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-remote-debuginfo","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-tests","fixed_in":["5:5.2.2-6.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo","fixed_in":["2:1.16.1-1.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo-debuginfo","fixed_in":["2:1.16.1-1.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo-debugsource","fixed_in":["2:1.16.1-1.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo-tests","fixed_in":["2:1.16.1-1.rhaos4.18.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo","fixed_in":["2:1.18.1-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-debuginfo","fixed_in":["2:1.18.1-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-debugsource","fixed_in":["2:1.18.1-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-tests","fixed_in":["2:1.18.1-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-debuginfo","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-debugsource","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-tests","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-tests-debuginfo","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo","fixed_in":["2:1.18.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo-debuginfo","fixed_in":["2:1.18.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo-debugsource","fixed_in":["2:1.18.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo-tests","fixed_in":["2:1.18.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"buildah","fixed_in":["2:1.39.4-1.el9_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"skopeo","fixed_in":["2:1.18.1-1.el9_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"buildah","fixed_in":["2:1.39.4-1.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"skopeo","fixed_in":["2:1.18.1-1.el10_0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"skopeo","fixed_in":["1.14.4-150300.11.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"podman","fixed_in":["4.9.5-150500.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"podman","fixed_in":["4.9.5-150500.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"podman","fixed_in":["4.9.5-150500.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"podman","fixed_in":["4.9.5-150500.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"podman","fixed_in":["4.9.5-150500.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"podman","fixed_in":["4.9.5-150500.3.37.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"podman","fixed_in":["4.9.5-150500.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"podman","fixed_in":["4.9.5-150400.4.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"podman","fixed_in":["4.9.5-150400.4.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"podman","fixed_in":["4.9.5-150400.4.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"podman","fixed_in":["4.9.5-150400.4.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"podman","fixed_in":["4.9.5-150400.4.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"podman","fixed_in":["4.9.5-150400.4.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"buildah","fixed_in":["1.35.5-150500.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"buildah","fixed_in":["1.35.5-150500.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"buildah","fixed_in":["1.35.5-150500.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"buildah","fixed_in":["1.35.5-150500.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"buildah","fixed_in":["1.35.5-150500.3.31.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"buildah","fixed_in":["1.35.5-150500.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"buildah","fixed_in":["1.35.5-150400.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"buildah","fixed_in":["1.35.5-150400.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"buildah","fixed_in":["1.35.5-150400.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"buildah","fixed_in":["1.35.5-150400.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","fixed_in":["10.4.15-150000.1.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","fixed_in":["10.4.15-1.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"grafana","fixed_in":["10.4.15-150200.3.69.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"grafana","fixed_in":["10.4.15-150200.3.67.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"trivy","fixed_in":["0.59.1-bp156.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"trivy","fixed_in":["0.59.1-bp156.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["11.5.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"podman","fixed_in":["5.4.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gh","fixed_in":["2.73.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-jose/go-jose/v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-jose/go-jose/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-jose/go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"134.1-3.el10_0.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"134.1-3.el10_0.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"134.1-3.el10_0.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dcos-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kube-vip-cloud-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.2-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.4-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.10-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.0-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-27"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.13-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.26-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.4-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.4-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-25"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"dcos-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.1-26"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.18.0-29"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.4-1.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.4-1.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.2-0.1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.2-0.1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"76-2.el9_2.2.alma.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"76-2.el9_2.2.alma.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-dnf-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"76-2.el9_2.2.alma.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"76-2.el9_2.2.alma.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"76-2.el9_2.2.alma.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.6-1.el9_2.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.6-1.el9_2.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.4.1-13.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.4.1-13.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.4.1-13.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.4.1-13.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.4.1-13.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.4.1-13.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/square/go-jose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-7.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-6.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-13.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-7.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-7.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-6.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-6.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-10.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-7.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:132.2-3.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-4.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.17.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.2.2-6.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.1-1.rhaos4.18.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.107.0-8.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.107.0-7.el9_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.107.0-8.el9_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.107.0-9.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el9_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-9.el9_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el9_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.4-1.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.4.0-9.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.1-1.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.107.0-9.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.47.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.47.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.47.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.47.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.47.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.47.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.49.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.49.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.49.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.49.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.49.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.49.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15.2-150400.3.133.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.37.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.31.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP6","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-150600.4.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-150600.4.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-150000.1.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-1.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-150200.3.69.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-150200.3.67.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.40.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-150400.4.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-150400.3.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-slfo.1.1_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150600.4.12.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"squashfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150600.3.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150600.4.12.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"squashfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150600.3.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150600.4.12.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"squashfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150600.3.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1+git78.f951e3a-150000.1.11.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-12.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.68.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.68.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.68.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.68.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.62.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.62.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.62.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.62.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.62.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.62.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150500.3.62.1"}]}],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-1","3.0.1-2","4.0.1-4","4.0.1-4ubuntu0.1","4.0.1-4ubuntu0.2","4.0.1-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1build1","4.1.4-1","4.1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1","4.0.5-1build1","4.0.5-1ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.59.1-bp156.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.59.1-bp156.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.2.9-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.59.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250312T181707-1.1"}]}],"bundled":31},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.73.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.26-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git163.87ee3570-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1+git78.f951e3a-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubectl-retina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.96.0-bp160.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4+git20.5d61136-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"go-jose","product":"go-jose"}],"references":[{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/go-jose/go-jose/releases/tag/v4.0.5","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://github.com/golang/go/issues/71490","tags":["web"]},{"url":"https://go.dev/issue/71490","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27144","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c6gw-w398-hv78"},{"url":"https://access.redhat.com/errata/RHSA-2025:19566","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-27144","tags":["report"]},{"url":"https://bugzilla.redhat.com/2347423","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-19566.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7389","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7389.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7397","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7397.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7459","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7459.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7462","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22869","tags":["report"]},{"url":"https://bugzilla.redhat.com/2348367","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7462.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7467","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7467.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1752088672.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762421840.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1764152728.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1764692266.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1766596893.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791280549.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27144.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-27144","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2176","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2177","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47907","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2223","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2224","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2225","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2233","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9407","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22869","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2347423","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-121533","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19566.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27144","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:19594","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-102832","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19594.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3061","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3061.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3068","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3068.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3335","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2341751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2348366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2352914","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3335.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45336","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/70530","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22868","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22868","tags":["advisory"]},{"url":"https://go.dev/cl/652155","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3488","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-29786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-29786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29786","tags":["advisory"]},{"url":"https://github.com/expr-lang/expr/pull/762","tags":["article"]},{"url":"https://github.com/expr-lang/expr/security/advisories/GHSA-93mq-9ffx-83m2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3593","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3593.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-80997","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-85114","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7389.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7391","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2348367","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-79694","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-80259","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-82509","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-85116","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-85218","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-86092","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7391.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22869","tags":["advisory"]},{"url":"https://go.dev/cl/652135","tags":["article"]},{"url":"https://go.dev/issue/71931","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3487","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7397.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7407","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2354195","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7407.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30204","tags":["advisory"]},{"url":"https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3","tags":["article"]},{"url":"https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3553","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-80996","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-85115","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7459.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-79695","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-80260","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-82511","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-85117","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-85219","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-86093","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7462.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7467.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7479","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7479.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7389","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7391","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7397","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7459","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7462","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7467","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7479","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2025-2091/suse-ru-202502091-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239776","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2025-2092/suse-ru-202502092-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2025-2093/suse-ru-202502093-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501985-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4123","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250772-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237613","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250775-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214612","tags":["report"]},{"url":"https://bugzilla.suse.com/1215807","tags":["report"]},{"url":"https://bugzilla.suse.com/1215926","tags":["report"]},{"url":"https://bugzilla.suse.com/1217828","tags":["report"]},{"url":"https://bugzilla.suse.com/1221677","tags":["report"]},{"url":"https://bugzilla.suse.com/1227052","tags":["report"]},{"url":"https://bugzilla.suse.com/1231208","tags":["report"]},{"url":"https://bugzilla.suse.com/1231230","tags":["report"]},{"url":"https://bugzilla.suse.com/1231499","tags":["report"]},{"url":"https://bugzilla.suse.com/1231698","tags":["report"]},{"url":"https://bugzilla.suse.com/1236270","tags":["report"]},{"url":"https://bugzilla.suse.com/1236507","tags":["report"]},{"url":"https://bugzilla.suse.com/1237641","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-1753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9676","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250785-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250786-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250811-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237681","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250812-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250813-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236531","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250980-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228324","tags":["report"]},{"url":"https://bugzilla.suse.com/1234595","tags":["report"]},{"url":"https://bugzilla.suse.com/1234794","tags":["report"]},{"url":"https://bugzilla.suse.com/1237679","tags":["report"]},{"url":"https://bugzilla.suse.com/1238611","tags":["report"]},{"url":"https://bugzilla.suse.com/1239341","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251009-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237671","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251010-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251011-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251014-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239339","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251017-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251018-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251036-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239330","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251037-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251038-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251332-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227053","tags":["report"]},{"url":"https://bugzilla.suse.com/1236519","tags":["report"]},{"url":"https://bugzilla.suse.com/1237638","tags":["report"]},{"url":"https://bugzilla.suse.com/1239191","tags":["report"]},{"url":"https://bugzilla.suse.com/1239327","tags":["report"]},{"url":"https://bugzilla.suse.com/1240468","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251333-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227031","tags":["report"]},{"url":"https://bugzilla.suse.com/1232985","tags":["report"]},{"url":"https://bugzilla.suse.com/1237682","tags":["report"]},{"url":"https://bugzilla.suse.com/1238693","tags":["report"]},{"url":"https://bugzilla.suse.com/1239204","tags":["report"]},{"url":"https://bugzilla.suse.com/1239337","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520143-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227056","tags":["report"]},{"url":"https://bugzilla.suse.com/1236483","tags":["report"]},{"url":"https://bugzilla.suse.com/1238685","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520198-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520279-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224112","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520363-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520869-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249154","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9566","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260439-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237608","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://bugzilla.suse.com/1241710","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253784","tags":["report"]},{"url":"https://bugzilla.suse.com/1253967","tags":["report"]},{"url":"https://bugzilla.suse.com/1255462","tags":["report"]},{"url":"https://bugzilla.suse.com/1257432","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8556","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260592-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234486","tags":["report"]},{"url":"https://bugzilla.suse.com/1237611","tags":["report"]},{"url":"https://bugzilla.suse.com/1238683","tags":["report"]},{"url":"https://bugzilla.suse.com/1239186","tags":["report"]},{"url":"https://bugzilla.suse.com/1239323","tags":["report"]},{"url":"https://bugzilla.suse.com/1240444","tags":["report"]},{"url":"https://bugzilla.suse.com/1253802","tags":["report"]},{"url":"https://bugzilla.suse.com/1256535","tags":["report"]},{"url":"https://bugzilla.suse.com/1257138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622516-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262856","tags":["report"]},{"url":"https://bugzilla.suse.com/1266125","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262706-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262953","tags":["report"]},{"url":"https://bugzilla.suse.com/1266191","tags":["report"]},{"url":"https://bugzilla.suse.com/1266648","tags":["report"]},{"url":"https://bugzilla.suse.com/1267179","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262733-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-27144","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N7HT377S427BEOJBVSVDIDXHCBYPR7BR/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237618","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/A6CKDKOLFT3FBRNIKECBJKGOC3PU3UIC/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BSWXCPWQTROX3SPB557CKOCT4MAX7ILY/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27509","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIPGSRATX6BG2ZXWE7566EGQCKXLC4RV/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IQWUH5CIGBJCVZRE6D76AYCLT3MS47XX/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IC2EUYZRCX6GXM6Y26SHEX6QS2URIZ2I/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27152","tags":["web"]},{"url":"https://bugzilla.suse.com/1227010","tags":["report"]},{"url":"https://bugzilla.suse.com/1232948","tags":["report"]},{"url":"https://bugzilla.suse.com/1234512","tags":["report"]},{"url":"https://bugzilla.suse.com/1235265","tags":["report"]},{"url":"https://bugzilla.suse.com/1239225","tags":["report"]},{"url":"https://bugzilla.suse.com/1239385","tags":["report"]},{"url":"https://bugzilla.suse.com/1240466","tags":["report"]},{"url":"https://bugzilla.suse.com/1241724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243633","tags":["report"]},{"url":"https://bugzilla.suse.com/1246151","tags":["report"]},{"url":"https://bugzilla.suse.com/1246730","tags":["report"]},{"url":"https://bugzilla.suse.com/1248897","tags":["report"]},{"url":"https://bugzilla.suse.com/1248937","tags":["report"]},{"url":"https://bugzilla.suse.com/1250625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95838","tags":["web"]},{"url":"https://bugzilla.suse.com/1231844","tags":["report"]},{"url":"https://bugzilla.suse.com/1232975","tags":["report"]},{"url":"https://bugzilla.suse.com/1233343","tags":["report"]},{"url":"https://bugzilla.suse.com/1235206","tags":["report"]},{"url":"https://bugzilla.suse.com/1235574","tags":["report"]},{"url":"https://bugzilla.suse.com/1236510","tags":["report"]},{"url":"https://bugzilla.suse.com/1236559","tags":["report"]},{"url":"https://bugzilla.suse.com/1236734","tags":["report"]},{"url":"https://bugzilla.suse.com/1238703","tags":["report"]},{"url":"https://bugzilla.suse.com/1241683","tags":["report"]},{"url":"https://bugzilla.suse.com/1241687","tags":["report"]},{"url":"https://bugzilla.suse.com/1241809","tags":["report"]},{"url":"https://bugzilla.suse.com/1243672","tags":["report"]},{"url":"https://bugzilla.suse.com/1243714","tags":["report"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1246735","tags":["report"]},{"url":"https://bugzilla.suse.com/1246736","tags":["report"]},{"url":"https://bugzilla.suse.com/1250616","tags":["report"]},{"url":"https://bugzilla.suse.com/1251454","tags":["report"]},{"url":"https://bugzilla.suse.com/1251657","tags":["report"]},{"url":"https://bugzilla.suse.com/1254113","tags":["report"]},{"url":"https://bugzilla.suse.com/1255340","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://bugzilla.suse.com/1235211","tags":["report"]},{"url":"https://bugzilla.suse.com/1236528","tags":["report"]},{"url":"https://bugzilla.suse.com/1253924","tags":["report"]},{"url":"https://bugzilla.suse.com/1258047","tags":["report"]},{"url":"https://bugzilla.suse.com/1258048","tags":["report"]},{"url":"https://bugzilla.suse.com/1260311","tags":["report"]},{"url":"https://bugzilla.suse.com/1262956","tags":["report"]},{"url":"https://bugzilla.suse.com/1264177","tags":["report"]},{"url":"https://bugzilla.suse.com/1251363","tags":["report"]},{"url":"https://bugzilla.suse.com/1251547","tags":["report"]},{"url":"https://bugzilla.suse.com/1253512","tags":["report"]},{"url":"https://bugzilla.suse.com/1253786","tags":["report"]},{"url":"https://bugzilla.suse.com/1253977","tags":["report"]},{"url":"https://bugzilla.suse.com/1233387","tags":["report"]},{"url":"https://bugzilla.suse.com/1234566","tags":["report"]},{"url":"https://bugzilla.suse.com/1235345","tags":["report"]},{"url":"https://bugzilla.suse.com/1237669","tags":["report"]},{"url":"https://bugzilla.suse.com/1239496","tags":["report"]},{"url":"https://bugzilla.suse.com/1241837","tags":["report"]},{"url":"https://bugzilla.suse.com/1243930","tags":["report"]},{"url":"https://bugzilla.suse.com/1251464","tags":["report"]},{"url":"https://bugzilla.suse.com/1251666","tags":["report"]},{"url":"https://bugzilla.suse.com/1253929","tags":["report"]},{"url":"https://bugzilla.suse.com/1258617","tags":["report"]},{"url":"https://bugzilla.suse.com/1260271","tags":["report"]},{"url":"https://bugzilla.suse.com/1262339","tags":["report"]},{"url":"https://bugzilla.suse.com/1262943","tags":["report"]},{"url":"https://bugzilla.suse.com/1265405","tags":["report"]},{"url":"https://bugzilla.suse.com/1265777","tags":["report"]},{"url":"https://bugzilla.suse.com/1266173","tags":["report"]},{"url":"https://bugzilla.suse.com/1266618","tags":["report"]},{"url":"https://bugzilla.suse.com/1266975","tags":["report"]},{"url":"https://bugzilla.suse.com/1267158","tags":["report"]},{"url":"https://bugzilla.suse.com/1269427","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52308","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-27144","title":"Go JOSE's Parsing Vulnerable to Denial of Service","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T22:22:22.863Z","modified":"2025-02-25T14:27:04.978Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-4268","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T22:22:22Z","modified":"2025-02-25T14:27:04Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T20:53:25.075327Z"}],"ghsa":[{"id":"GHSA-c6gw-w398-hv78","title":"DoS in go-jose Parsing","description":"### Impact\nWhen parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.\n\n### Patches\nVersion 4.0.5 fixes this issue\n\n### Workarounds\nApplications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.\n\n### References\nThis is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.","status":"published","published":"2025-02-24T22:49:19Z","modified":"2025-02-26T22:16:38Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:38:33.163519Z"}],"nvd":[{"id":"CVE-2025-27144","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11.427Z","modified":"2026-06-17T09:03:05.677Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:10:51.871789Z"}],"osv":[{"id":"CVE-2025-27144","title":"Go JOSE's Parsing Vulnerable to Denial of Service","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T22:22:22.863Z","modified":"2026-10-28T17:27:14.336783669Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-27144","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11.427Z","modified":"2026-09-01T20:05:44.949495037Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-c6gw-w398-hv78","title":"DoS in go-jose Parsing","description":"### Impact\nWhen parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.\n\n### Patches\nVersion 4.0.5 fixes this issue\n\n### Workarounds\nApplications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.\n\n### References\nThis is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.","status":"published","published":"2025-02-24T22:49:19Z","modified":"2026-09-10T03:50:22.593784301Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"OESA-2025-2176","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:40.187813581Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2177","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:09.721694806Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2221","title":"skopeo security update","description":"A command line utility that performs various operations on container images and image repositories\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.(CVE-2024-3727)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)","status":"published","published":"2025-09-05T11:09:17Z","modified":"2026-08-18T01:18:11.208033165Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2222","title":"skopeo security update","description":"A command line utility that performs various operations on container images and image repositories\r\n\r\nSecurity Fix(es):\n\nA malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.(CVE-2023-39325)\n\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)","status":"published","published":"2025-09-05T11:09:18Z","modified":"2026-08-18T01:18:11.319380323Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2223","title":"skopeo security update","description":"A command line utility that performs various operations on container images and image repositories\r\n\r\nSecurity Fix(es):\n\nA malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.(CVE-2023-39325)\n\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)","status":"published","published":"2025-09-05T11:09:18Z","modified":"2026-08-18T01:18:11.230351284Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2224","title":"skopeo security update","description":"A command line utility that performs various operations on container images and image repositories\r\n\r\nSecurity Fix(es):\n\nA malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.(CVE-2023-39325)\n\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)","status":"published","published":"2025-09-05T11:09:18Z","modified":"2026-08-18T01:18:11.319859088Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2225","title":"skopeo security update","description":"A command line utility that performs various operations on container images and image repositories\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.(CVE-2024-3727)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)","status":"published","published":"2025-09-05T11:09:18Z","modified":"2026-08-18T01:18:11.318187083Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2233","title":"skopeo security update","description":"A command line utility that performs various operations on container images and image repositories\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.(CVE-2024-3727)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)","status":"published","published":"2025-09-12T11:09:18Z","modified":"2026-08-18T01:18:11.205522152Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2258","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:10.865304986Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2297","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.(CVE-2024-11218)\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\n\nSSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.(CVE-2025-22869)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-19T11:09:22Z","modified":"2026-08-18T01:19:10.313388708Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2025:19566","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2025-11-04T10:04:03Z","modified":"2026-10-17T10:05:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:19594","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2025-11-04T10:04:04Z","modified":"2026-10-17T10:05:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:3061","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.22 packages and security update","status":"published","published":"2025-03-27T10:03:24Z","modified":"2026-10-17T10:06:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3068","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.6 packages and security update","status":"published","published":"2025-03-26T10:05:30Z","modified":"2026-10-17T10:06:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3335","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2025-03-28T10:04:20Z","modified":"2026-10-20T10:03:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3593","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2025-04-04T10:04:19Z","modified":"2026-10-20T10:03:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7389","title":"Red Hat Security Advisory: buildah security update","status":"published","published":"2025-05-14T10:06:09Z","modified":"2026-10-17T10:07:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7391","title":"Red Hat Security Advisory: podman security update","status":"published","published":"2025-05-14T10:06:09Z","modified":"2026-10-20T10:04:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7397","title":"Red Hat Security Advisory: skopeo security update","status":"published","published":"2025-05-14T10:06:11Z","modified":"2026-10-17T10:07:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7407","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2025-05-14T10:06:13Z","modified":"2026-10-20T10:04:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7459","title":"Red Hat Security Advisory: buildah security update","status":"published","published":"2025-05-14T10:06:30Z","modified":"2026-10-17T10:07:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7462","title":"Red Hat Security Advisory: podman security update","status":"published","published":"2025-05-14T10:06:31Z","modified":"2026-10-20T10:04:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7467","title":"Red Hat Security Advisory: skopeo security update","status":"published","published":"2025-05-14T10:06:32Z","modified":"2026-10-17T10:07:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7479","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2025-05-14T10:06:34Z","modified":"2026-10-20T10:04:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7389","title":"Moderate: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-04T00:49:49.822133Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7391","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:31.117785Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7397","title":"Moderate: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. \n\nSecurity Fix(es):\n\n* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:31.425747Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7459","title":"Moderate: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:39.56808Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7462","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:38.858613Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7467","title":"Moderate: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. \n\nSecurity Fix(es):\n\n* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:18:58.813181Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7479","title":"Important: opentelemetry-collector security update","description":"Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry\n\nSecurity Fix(es):\n\n* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n* golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868)\n\n* github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786)\n\n* golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:39.190799Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-27144","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:00Z","modified":"2026-10-17T12:56:50.000078866Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:19566","title":"Moderate: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  \n\nSecurity Fix(es):  \n\n  * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-11-04T00:00:00Z","modified":"2026-10-29T11:58:12.876073Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7389","title":"Moderate: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   \n\nSecurity Fix(es):  \n\n  * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:29.367182341Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7397","title":"Moderate: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   \n\nSecurity Fix(es):  \n\n  * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:29.504761061Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7459","title":"Moderate: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   \n\nSecurity Fix(es):  \n\n  * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:16.980316Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7462","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  \n\nSecurity Fix(es):  \n\n  * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n  * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:16.47261Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7467","title":"Moderate: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   \n\nSecurity Fix(es):  \n\n  * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:15.644146Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-57096","title":"CVE-2025-27144 affecting package skopeo for versions less than 1.14.4-4","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57099","title":"CVE-2025-27144 affecting package influxdb for versions less than 2.6.1-21","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-04-21T04:36:51.068992Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57102","title":"CVE-2025-27144 affecting package dcos-cli for versions less than 1.2.0-17","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57105","title":"CVE-2025-27144 affecting package ig for versions less than 0.37.0-3","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-04-21T04:49:11.111471Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57108","title":"CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-04-21T04:36:51.061165Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57111","title":"CVE-2025-27144 affecting package cri-o 1.30.1-1","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57114","title":"CVE-2025-27144 affecting package buildah for versions less than 1.41.4-2","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-04-21T04:50:41.792805Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-57117","title":"CVE-2025-27144 affecting package kubernetes for versions less than 1.30.10-3","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57120","title":"CVE-2025-27144 affecting package moby-containerd-cc for versions less than 1.7.7-9","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.","status":"published","published":"2025-02-24T23:15:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"}]},"sources_more":{"osv":86}}