{"id":"CVE-2026-78663","aliases":["ALPINE-CVE-2026-78663","ALSA-2026:86093","ALSA-2026:86196","ALSA-2026:86203","AZL-107024","AZL-107051","AZL-107066","AZL-107093","AZL-107120","AZL-107147","AZL-107162","AZL-107168","AZL-107192","AZL-107207","AZL-107219","AZL-107246","AZL-107264","AZL-107276","AZL-107294","AZL-107318","AZL-107330","AZL-107363","AZL-107366","AZL-107384","AZL-107412","AZL-107427","AZL-107508","AZL-107523","AZL-107541","AZL-107567","AZL-107592","AZL-107616","AZL-107628","AZL-107643","AZL-107667","AZL-107679","AZL-107712","AZL-107724","AZL-107736","AZL-107760","AZL-107772","AZL-107796","AZL-107814","AZL-107829","AZL-107847","AZL-107874","AZL-107895","AZL-107904","AZL-107937","AZL-108216","AZL-108233","AZL-108360","AZL-108465","AZL-108552","AZL-111569","BELL-CVE-2026-78663","BIT-golang-2026-78663","DEBIAN-CVE-2026-78663","EUVD-2026-95427","GO-2026-6612","MGASA-2026-0497","MGASA-2026-0586","SUSE-SU-2026:24237-1","SUSE-SU-2026:24359-1","SUSE-SU-2026:24475-1","SUSE-SU-2026:24555-1","SUSE-SU-2026:24604-1","SUSE-SU-2026:4625-1","SUSE-SU-2026:4864-1","SUSE-SU-2026:4866-1","SUSE-SU-2026:4867-1","UBUNTU-CVE-2026-78663","USN-8935-1","openSUSE-SU-2026:12101-1","openSUSE-SU-2026:12112-1","openSUSE-SU-2026:12207-1","openSUSE-SU-2026:12212-1","openSUSE-SU-2026:12214-1","openSUSE-SU-2026:12261-1","openSUSE-SU-2026:12267-1","openSUSE-SU-2026:12268-1","openSUSE-SU-2026:12283-1","openSUSE-SU-2026:12286-1","openSUSE-SU-2026:12287-1","openSUSE-SU-2026:12293-1","openSUSE-SU-2026:12309-1","openSUSE-SU-2026:12317-1","openSUSE-SU-2026:12326-1","openSUSE-SU-2026:12414-1","openSUSE-SU-2026:12446-1","openSUSE-SU-2026:22093-1","openSUSE-SU-2026:22152-1","openSUSE-SU-2026:22180-1","openSUSE-SU-2026:22218-1"],"status":"published","title":"Double flow control refund on HTTP/2 server streams in net/http","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00858,"percentile":0.58758,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-675"],"published":"2026-10-08T22:31:09Z","modified":"2026-11-10T16:45:03Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"docker","fixed_in":["29.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-15"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cloud-provider-kubevirt","fixed_in":["0.5.1-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerized-data-importer","fixed_in":["1.62.0-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"etcd","fixed_in":["3.5.35-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"influxdb","fixed_in":["2.7.5-22"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["4.1.0.kata1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers-cc","fixed_in":["3.15.0.aks0-23"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","fixed_in":["0.0.10-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.10-32"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.8.4-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-containerd-cc","fixed_in":["1.7.7-19"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"opa","fixed_in":["0.63.0-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"prometheus-adapter","fixed_in":["0.12.0-12"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"prometheus-node-exporter","fixed_in":["1.7.0-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"prometheus-process-exporter","fixed_in":["0.8.2-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"docker","fixed_in":["29.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"go","fixed_in":["1.27.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"go","fixed_in":["1.27.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.26","fixed_in":["1.26.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.27","fixed_in":["1.27.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-golang-x-net","fixed_in":["1:0.60.0-1"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]},{"ecosystem":"Go","package":"golang.org/x/net","fixed_in":["0.60.0"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","fixed_in":["1.22.2-2~22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","fixed_in":["1.22.2-2ubuntu0.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hugo","fixed_in":["0.168.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"amazon-ssm-agent","fixed_in":["3.3.5708.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"Azure Linux:3","package":"azl-otel-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.127.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.27.0~preview2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"application-gateway-kubernetes-ingress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.7-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.25.1-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"azurelinux-image-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cf-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.7.11-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cloud-provider-kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.62.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.4-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.32.0-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.0-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.7-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.27.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.35-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"flannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.24.2-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.101.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.1-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ignition-flatcar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.22.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-22"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"jx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.10.182-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0.kata1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0.aks0-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.10-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.10-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"multus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.2-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.5-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus-node-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus-process-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.4-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"sriov-network-device-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.7.0-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.31.0-33"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.0.4-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gcc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.2.0-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt-openvmm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.10.21-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.4-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.40.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"calicoctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cilium-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0-r12"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cni-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"docker-cli-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20250521.00-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"osv-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rootlesskit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"calicoctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cilium-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0-r12"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cni-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.2-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.2-r0"},{"fixed":"29.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker-cli-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.27.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20250214.01-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"grype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.100.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"osv-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rootlesskit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.7-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.27.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.12-1","1.24.13-1","1.24.13-2","1.24.4-1","1.24.4-2","1.24.4-3","1.24.4-4","1.24.7-1","1.24.8-1","1.24.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1"}]}],"versions":["1.26.0-1","1.26.1-1","1.26.2-1","1.26.2-2","1.26.2-3","1.26.3-1","1.26.3-1~bpo13+1","1.26.3-2","1.26.3-2~bpo13+1","1.26.4-1","1.26.4-1~bpo13+1","1.26.5-1","1.26.5-1~bpo13+1","1.26.6-1","1.26.6-2","1.26.7-1","1.26.7-1~bpo13+1","1.26.8-1","1.26.8-1~bpo13+1","1.26.8-2","1.26~rc2-1","1.26~rc3-1","1.26~rc3-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-1"}]}],"versions":["1.27.0-1","1.27.0-1~bpo13+1","1.27.1-1","1.27.1-2","1.27.1-2~bpo13+1","1.27.2-1~bpo13+1","1.27~rc1-1","1.27~rc2-1","1.27~rc3-1"]},{"source":"osv","ecosystem":"Debian:12","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.11.0-1","1:0.14.0-1","1:0.15.0-1","1:0.15.0-2","1:0.17.0+dfsg-1","1:0.19.0+dfsg-1","1:0.20.0+dfsg-1","1:0.21.0+dfsg-1","1:0.22.0+dfsg-1","1:0.23.0+dfsg-1","1:0.24.0+dfsg-1","1:0.25.0+dfsg-1","1:0.26.0+dfsg-1","1:0.26.0+dfsg-2","1:0.27.0-1","1:0.27.0-2","1:0.47.0-1","1:0.47.0-2","1:0.53.0-1","1:0.53.0-2","1:0.53.0-2~bpo13+1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.58.0-1","1:0.60.0-1","1:0.7.0+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.27.0-2","1:0.47.0-1","1:0.47.0-2","1:0.53.0-1","1:0.53.0-2","1:0.53.0-2~bpo13+1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.58.0-1","1:0.60.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.60.0-1"}]}],"versions":["1:0.27.0-2","1:0.47.0-1","1:0.47.0-2","1:0.53.0-1","1:0.53.0-2","1:0.53.0-2~bpo13+1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.58.0-1"]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/net","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.60.0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1.mga10"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-2.mga10"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20261022.00-159998.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20261022.00-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-golang-x-net-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0+git20150226.3d87fd6-3","0.0+git20151007.b846920+dfsg-1","1:0.0+git20150817.66f0418-1","1:0.0+git20160110.4fd4a9f-1","1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1","1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"juju-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.6-0ubuntu3","1.25.0-0ubuntu1","1.25.0-0ubuntu2","1.25.0-0ubuntu3","2.0~beta4-0ubuntu2","2.0~beta6-0ubuntu1.16.04.1","2.0~beta7-0ubuntu1.16.04.1","2.0~beta12-0ubuntu1.16.04.1","2.0~beta15-0ubuntu2.16.04.1","2.0.0-0ubuntu0.16.04.2","2.0.2-0ubuntu0.16.04.1","2.0.2-0ubuntu0.16.04.2","2.3.1-0ubuntu0.16.04.1","2.3.2-0ubuntu0.16.04.1","2.3.7-0ubuntu0.16.04.1","2.3.7-0ubuntu0.16.04.1+esm1","2.3.7-0ubuntu0.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-0ubuntu4","0.21-0ubuntu3","0.21-0ubuntu5","0.22-0ubuntu1","0.22-0ubuntu2","0.23-0ubuntu1","0.23-0ubuntu2","0.23-0ubuntu3","0.24-0ubuntu2","0.24-0ubuntu3","0.24-0ubuntu4","0.25-0ubuntu1","0.26-0ubuntu2","0.26-0ubuntu3","0.27-0ubuntu1","0.27-0ubuntu2","2.0.0~beta1-0ubuntu3","2.0.0~beta1-0ubuntu4","2.0.0~beta2-0ubuntu1","2.0.0~beta2-0ubuntu2","2.0.0~beta3-0ubuntu1","2.0.0~beta3-0ubuntu2","2.0.0~beta3-0ubuntu3","2.0.0~beta3-0ubuntu4","2.0.0~beta4-0ubuntu1","2.0.0~beta4-0ubuntu2","2.0.0~beta4-0ubuntu3","2.0.0~beta4-0ubuntu4","2.0.0~beta4-0ubuntu5","2.0.0~beta4-0ubuntu6","2.0.0~beta4-0ubuntu7","2.0.0~rc1-0ubuntu1","2.0.0~rc1-0ubuntu2","2.0.0~rc1-0ubuntu3","2.0.0~rc2-0ubuntu2","2.0.0~rc2-0ubuntu3","2.0.0~rc3-0ubuntu1","2.0.0~rc3-0ubuntu2","2.0.0~rc3-0ubuntu3","2.0.0~rc3-0ubuntu4","2.0.0~rc4-0ubuntu1","2.0.0~rc5-0ubuntu1","2.0.0~rc6-0ubuntu1","2.0.0~rc6-0ubuntu2","2.0.0~rc7-0ubuntu1","2.0.0~rc7-0ubuntu2","2.0.0~rc8-0ubuntu1","2.0.0~rc8-0ubuntu2","2.0.0~rc8-0ubuntu3","2.0.0~rc8-0ubuntu5","2.0.0~rc8-0ubuntu6","2.0.0~rc8-0ubuntu7","2.0.0~rc9-0ubuntu2","2.0.0~rc9-0ubuntu3","2.0.0~rc9-0ubuntu4","2.0.0~rc9-0ubuntu5","2.0.0-0ubuntu1","2.0.0-0ubuntu2","2.0.0-0ubuntu3","2.0.0-0ubuntu4","2.0.1-0ubuntu1~16.04.1","2.0.2-0ubuntu1~16.04.1","2.0.3-0ubuntu1~ubuntu16.04.2","2.0.4-0ubuntu1~ubuntu16.04.1","2.0.5-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.2","2.0.9-0ubuntu1~16.04.1","2.0.9-0ubuntu1~16.04.2","2.0.10-0ubuntu1~16.04.1","2.0.10-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.4","2.0.11-0ubuntu1~16.04.4+esm1","2.0.11-0ubuntu1~16.04.4+esm2","2.0.11-0ubuntu1~16.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1","1.2.6-0ubuntu1~16.04.6+esm2","1.2.6-0ubuntu1~16.04.6+esm4","1.2.6-0ubuntu1~16.04.6+esm5","1.2.6-0ubuntu1~16.04.6+esm6","1.2.6-0ubuntu1~16.04.6+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0","20240716.00-0ubuntu1~16.04.0+esm1","20240716.00-0ubuntu1~16.04.0+esm2","20240716.00-0ubuntu1~16.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20210219.00-0ubuntu1~16.04.0","20230504.00-0ubuntu1~16.04.0","20240320.00-0ubuntu1~16.04.0","20240524.03-0ubuntu2~16.04.0","20251028.00-0ubuntu2~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18-0ubuntu6","2.19-0ubuntu1","2.20-0ubuntu3","2.20-0ubuntu4","2.21-0ubuntu1","2.21-0ubuntu2","2.21-0ubuntu3","2.21-0ubuntu4","3.0.0~beta2-0ubuntu3","3.0.0~beta3-0ubuntu3","3.0.0~beta5-0ubuntu2","3.0.0~beta7-0ubuntu1","3.0.0-0ubuntu1","3.0.0-0ubuntu2","3.0.0-0ubuntu3","3.0.0-0ubuntu4","3.0.1-0ubuntu1~18.04.1","3.0.2-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.2","3.0.3-0ubuntu1~18.04.2+esm1","3.0.3-0ubuntu1~18.04.2+esm2","3.0.3-0ubuntu1~18.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1","1.5.2-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.3","1.5.5-0ubuntu3~18.04.1","1.5.5-0ubuntu3~18.04.2","1.5.9-0ubuntu1~18.04.1","1.5.9-0ubuntu1~18.04.2","1.6.12-0ubuntu1~18.04.1","1.6.12-0ubuntu1~18.04.1+esm1","1.6.12-0ubuntu1~18.04.1+esm2","1.6.12-0ubuntu1~18.04.1+esm3","1.6.12-0ubuntu1~18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-golang-x-net-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0+git20170629.c81e7f2+dfsg-1ubuntu1","1:0.0+git20170629.c81e7f2+dfsg-1ubuntu2","1:0.0+git20170629.c81e7f2+dfsg-2","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0+esm1","20241011.01-0ubuntu1~18.04.0+esm2","20241011.01-0ubuntu1~18.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20210219.00-0ubuntu1~18.04.0","20210608.1-0ubuntu1~18.04.1","20210608.1-0ubuntu1~18.04.2","20220824.00-0ubuntu1~18.04.1","20230504.00-0ubuntu1~18.04.0","20240320.00-0ubuntu1~18.04.0","20240524.03-0ubuntu2~18.04.0","20240926.03-0ubuntu1~18.04.0","20251028.00-0ubuntu2~18.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"adsys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8~22.04","0.9.2~20.04","0.9.2~20.04.1","0.9.2~20.04.2","0.9.2~20.04.2ubuntu0.1","0.9.2~20.04.2ubuntu0.1+esm1","0.9.2~20.04.2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2","1.3.3-0ubuntu2.3","1.4.4-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.1","1.5.2-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.3","1.5.5-0ubuntu3~20.04.1","1.5.5-0ubuntu3~20.04.2","1.5.9-0ubuntu1~20.04.1","1.5.9-0ubuntu1~20.04.4","1.5.9-0ubuntu1~20.04.5","1.5.9-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.1","1.6.12-0ubuntu1~20.04.3","1.6.12-0ubuntu1~20.04.5","1.6.12-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.7","1.6.12-0ubuntu1~20.04.8","1.6.12-0ubuntu1~20.04.8+esm1","1.6.12-0ubuntu1~20.04.8+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2","20231004.02-0ubuntu1~20.04.3","20231004.02-0ubuntu1~20.04.4","20240716.00-0ubuntu1~20.04.0","20241011.01-0ubuntu1~20.04.1","20250116.00-0ubuntu1~20.04.0","20250116.00-0ubuntu1~20.04.0+esm1","20250116.00-0ubuntu1~20.04.0+esm2","20250116.00-0ubuntu1~20.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-golang-x-net-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0+git20190811.74dc4d7+dfsg-1","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20210219.00-0ubuntu1~20.04.0","20210608.1-0ubuntu1~20.04.0","20210608.1-0ubuntu1~20.04.1","20220824.00-0ubuntu1~20.04.1","20230504.00-0ubuntu1~20.04.0","20240320.00-0ubuntu1~20.04.0","20240320.00-0ubuntu1~20.04.1","20240524.03-0ubuntu2~20.04.0","20240926.03-0ubuntu1~20.04.0","20250115.01-0ubuntu1~20.04.0","20251028.00-0ubuntu2~20.04.0"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.7","1:0.8","1:0.9","1:0.10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"adsys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.1","0.7.1build1","0.8","0.8ubuntu1","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5~22.04","0.9.2~22.04","0.9.2~22.04.1","0.9.2~22.04.2","0.14.1~22.04","0.14.2~22.04","0.14.2~22.04ubuntu0.1","0.14.3~22.04","0.14.3~22.04ubuntu0.1","0.16.3~22.04.1","0.16.3~22.04.2","0.16.3~22.04.2ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.5-0ubuntu3","1.5.9-0ubuntu1","1.5.9-0ubuntu2","1.5.9-0ubuntu3","1.5.9-0ubuntu3.1","1.6.12-0ubuntu1~22.04.1","1.6.12-0ubuntu1~22.04.3","1.6.12-0ubuntu1~22.04.5","1.6.12-0ubuntu1~22.04.6","1.6.12-0ubuntu1~22.04.7","1.6.12-0ubuntu1~22.04.8","1.6.12-0ubuntu1~22.04.9","1.6.12-0ubuntu1~22.04.10","1.6.12-0ubuntu1~22.04.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2~22.04.4"}]}],"versions":["1.22.2-2~22.04","1.22.2-2~22.04.1","1.22.2-2~22.04.2","1.22.2-2~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2","20231004.02-0ubuntu1~22.04.3","20231004.02-0ubuntu1~22.04.4","20231004.02-0ubuntu1~22.04.5","20240716.00-0ubuntu1~22.04.0","20241011.01-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.1","20250116.00-0ubuntu1~22.04.2","20250116.00-0ubuntu1~22.04.3","20250116.00-0ubuntu1~22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20210608.1-0ubuntu1","20210608.1-0ubuntu2","20210608.1-0ubuntu3","20220824.00-0ubuntu1~22.04.1","20220824.00-0ubuntu1~22.04.2","20230504.00-0ubuntu1~22.04.0","20230504.00-0ubuntu1~22.04.1","20240320.00-0ubuntu1~22.04.0","20240320.00-0ubuntu1~22.04.1","20240524.03-0ubuntu2~22.04.0","20240524.03-0ubuntu2~22.04.1","20240926.03-0ubuntu1~22.04.0","20250115.01-0ubuntu1~22.04.0","20251028.00-0ubuntu2~22.04.0","20251028.00-0ubuntu2~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0+git20210119.5f4716e+dfsg-4","1:0.0+git20210805.aaa1db6+dfsg-1","1:0.0+git20211209.491a49a+dfsg-1","1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1","1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2","1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm3","1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"adsys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.1","0.13.2","0.13.3","0.14.1","0.14.1build1","0.14.1ubuntu0.24.04.1","0.14.2~24.04","0.14.2~24.04ubuntu0.1","0.14.3~24.04","0.14.3~24.04ubuntu0.1","0.16.3~24.04.1","0.16.3~24.04.2","0.16.3~24.04.2ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2ubuntu0.5"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2","1.22.2-2ubuntu0.1","1.22.2-2ubuntu0.2","1.22.2-2ubuntu0.3","1.22.2-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20230426.00-0ubuntu3","20231004.02-0ubuntu1","20231004.02-0ubuntu3","20240213.00-0ubuntu1","20240213.00-0ubuntu2","20240213.00-0ubuntu3","20240213.00-0ubuntu3.1","20240213.00-0ubuntu3.2","20240716.00-0ubuntu1~24.04.0","20240716.00-0ubuntu1~24.04.1","20241011.01-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.1","20250116.00-0ubuntu1~24.04.2","20250116.00-0ubuntu1~24.04.3","20250116.00-0ubuntu1~24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20230504.00-0ubuntu2","20230504.00-0ubuntu3","20240320.00-0ubuntu1~24.04.0","20240320.00-0ubuntu1~24.04.1","20240320.00-0ubuntu1~24.04.2","20240524.03-0ubuntu2~24.04.0","20240524.03-0ubuntu2~24.04.1","20240926.03-0ubuntu1~24.04.0","20250115.01-0ubuntu1~24.04.0","20250115.01-0ubuntu1~24.04.1","20251028.00-0ubuntu2~24.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.20~ds1-1ubuntu2","1.6.24~ds1-1ubuntu1","1.6.24~ds1-1ubuntu1.1","1.6.24~ds1-1ubuntu1.2","1.6.24~ds1-1ubuntu1.2+esm1","1.6.24~ds1-1ubuntu1.3","1.6.24~ds1-1ubuntu1.3+esm1","1.6.24~ds1-1ubuntu1.3+esm2","1.6.24~ds1-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.17.0+dfsg-1","1:0.20.0+dfsg-1","1:0.21.0+dfsg-1","1:0.21.0+dfsg-1ubuntu0.1~esm1","1:0.21.0+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"adsys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.4ubuntu1","0.16.4ubuntu2","0.17.0"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-10ubuntu1","2.1.9+ds1-2ubuntu1","2.1.9+ds1-3ubuntu1","2.1.9+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.2-3","1.26.4-1","1.26.5-1","1.26.6-2","1.26.7-1","1.26.8-1","1.26.8-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27~rc1-1","1.27~rc2-1","1.27~rc3-1","1.27.0-1","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.27.0-2","1:0.57.0-1","1:0.58.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250506.01-0ubuntu2","20250506.01-0ubuntu3","20260819.00+~20260819.00-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20251028.00-0ubuntu2","20251028.00-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"adsys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.3","0.16.3ubuntu1","0.16.4","0.16.4ubuntu1","0.16.4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-0ubuntu1","1.25.7-2","1.25.14-1~ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26~rc3-2","1.26.0-1","1.26.8-1~ubuntu0.26.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.27.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250506.01-0ubuntu1","20250506.01-0ubuntu2","20250506.01-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250701.00-0ubuntu1","20251028.00-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-8ubuntu1","1.7.24~ds1-10ubuntu1","1.7.24~ds1-10ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2~20.04.3"}]}],"versions":["1.22.2-2~20.04.1","1.22.2-2~20.04.2"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2~22.04.4"}]}],"versions":["1.22.2-2~22.04","1.22.2-2~22.04.1","1.22.2-2~22.04.2","1.22.2-2~22.04.3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2ubuntu0.5"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2","1.22.2-2ubuntu0.1","1.22.2-2ubuntu0.2","1.22.2-2ubuntu0.3","1.22.2-2ubuntu0.4"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4+git106.aa6ffc8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kyverno","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-3.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.2-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.34.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20261022.00-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20261022.00-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hugo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.168.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"timoni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.36.0-1.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5708.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kubevirt1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-bp160.4.1"}]}],"bundled":2}],"products":[{"vendor":"go standard library","product":"net/http"},{"vendor":"go standard library","product":"net/http/internal/http2"},{"vendor":"golang.org/x/net","product":"golang.org/x/net/http2"}],"references":[{"url":"https://go.dev/cl/847187","tags":["web","fix"]},{"url":"https://go.dev/cl/847310","tags":["web","fix"]},{"url":"https://go.dev/issue/81743","tags":["web","report"]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":["web"]},{"url":"https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6612","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-78663","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86093","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111943","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78667","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78669","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97031","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548334","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548336","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548344","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556068","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-86093.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-56866.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78659.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78660.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78663.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94439.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94440.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94444.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94447.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94448.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-97030.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-97032.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86196","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-86196.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86203","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-86203.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","tags":["web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-78663","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-78663","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0497.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36481","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/08/9","tags":["web","report"]},{"url":"https://advisories.mageia.org/MGASA-2026-0586.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35806","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-75-2-2026-10-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-1-2026-09-04","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-0-2026-07-31","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-74-4-2026-07-08","tags":["web"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624237-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272545","tags":["report"]},{"url":"https://bugzilla.suse.com/1284766","tags":["report"]},{"url":"https://bugzilla.suse.com/1284767","tags":["report"]},{"url":"https://bugzilla.suse.com/1284768","tags":["report"]},{"url":"https://bugzilla.suse.com/1284769","tags":["report"]},{"url":"https://bugzilla.suse.com/1284770","tags":["report"]},{"url":"https://bugzilla.suse.com/1284771","tags":["report"]},{"url":"https://bugzilla.suse.com/1284772","tags":["report"]},{"url":"https://bugzilla.suse.com/1284773","tags":["report"]},{"url":"https://bugzilla.suse.com/1284774","tags":["report"]},{"url":"https://bugzilla.suse.com/1284775","tags":["report"]},{"url":"https://bugzilla.suse.com/1284776","tags":["report"]},{"url":"https://bugzilla.suse.com/1284777","tags":["report"]},{"url":"https://bugzilla.suse.com/1284778","tags":["report"]},{"url":"https://bugzilla.suse.com/1284779","tags":["report"]},{"url":"https://bugzilla.suse.com/1284780","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624359-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255111","tags":["report"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286317","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111943","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253357","tags":["report"]},{"url":"https://bugzilla.suse.com/1273192","tags":["report"]},{"url":"https://bugzilla.suse.com/1285283","tags":["report"]},{"url":"https://bugzilla.suse.com/1286994","tags":["report"]},{"url":"https://bugzilla.suse.com/1287058","tags":["report"]},{"url":"https://bugzilla.suse.com/1287137","tags":["report"]},{"url":"https://bugzilla.suse.com/1287487","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624555-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285292","tags":["report"]},{"url":"https://bugzilla.suse.com/1288375","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116587","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264625-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264864-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264866-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264867-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-78663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78663","tags":["report"]},{"url":"https://github.com/golang/go/issues/81743","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8935-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-78659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-78660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-78667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-78669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94440","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-112085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-112366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85525","tags":["web"]},{"url":"https://bugzilla.suse.com/1272840","tags":["report"]},{"url":"https://bugzilla.suse.com/1285255","tags":["report"]},{"url":"https://bugzilla.suse.com/1286984","tags":["report"]},{"url":"https://bugzilla.suse.com/1287039","tags":["report"]},{"url":"https://bugzilla.suse.com/1287143","tags":["report"]},{"url":"https://bugzilla.suse.com/1287446","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13622","tags":["web"]},{"url":"https://bugzilla.suse.com/1288212","tags":["report"]},{"url":"https://bugzilla.suse.com/1288588","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-78663","title":"Double flow control refund on HTTP/2 server streams in net/http","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T22:53:59.772Z","modified":"2026-10-09T16:42:50.839Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-675"],"updated_at":"2026-11-02T13:34:48.658051Z"}],"euvd":[{"id":"EUVD-2026-95427","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T22:53:59Z","modified":"2026-10-09T16:42:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:24.64208Z"}],"nvd":[{"id":"CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03.647Z","modified":"2026-10-09T17:16:49.42Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-675"],"updated_at":"2026-11-02T14:12:55.473789Z"}],"osv":[{"id":"ALPINE-CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03.647Z","modified":"2026-11-03T06:33:06.407412822Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-78663","status":"published","published":"2026-10-09T06:05:29.985242Z","modified":"2026-10-21T07:15:06.135182552Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03.647Z","modified":"2026-10-12T22:00:13.833447073Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"UBUNTU-CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:00Z","modified":"2026-10-19T17:00:17.370446977Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"ALSA-2026:86093","title":"Important: golang security, bug fix, and enhancement update","description":"The golang packages provide the Go programming language compiler.  \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:42:19.545498615Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:86196","title":"Important: golang security, bug fix, and enhancement update","description":"The golang packages provide the Go programming language compiler.  \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:42:24.624651287Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:86203","title":"Important: go-toolset:rhel8 security, bug fix, and enhancement update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.   \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:12:06.542723063Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-107024","title":"CVE-2026-78663 affecting package azl-otel-collector 0.127.0-1","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107051","title":"CVE-2026-78663 affecting package buildah 1.43.1-3","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107066","title":"CVE-2026-78663 affecting package cri-o 1.30.1-1","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107093","title":"CVE-2026-78663 affecting package kata-containers-preview 3.27.0~preview2-2","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107120","title":"CVE-2026-78663 affecting package podman 5.6.1-10","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107147","title":"CVE-2026-78663 affecting package application-gateway-kubernetes-ingress 1.7.7-6","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107162","title":"CVE-2026-78663 affecting package azcopy 10.25.1-9","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107168","title":"CVE-2026-78663 affecting package azurelinux-image-tools 1.6.0-3","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107192","title":"CVE-2026-78663 affecting package cert-manager for versions less than 1.12.15-15","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107207","title":"CVE-2026-78663 affecting package cf-cli 8.7.11-9","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107219","title":"CVE-2026-78663 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107246","title":"CVE-2026-78663 affecting package containerd2 2.3.4-1","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107264","title":"CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107276","title":"CVE-2026-78663 affecting package coredns 1.11.4-21","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107294","title":"CVE-2026-78663 affecting package cri-tools 1.32.0-8","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107318","title":"CVE-2026-78663 affecting package docker-buildx 0.14.0-17","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107330","title":"CVE-2026-78663 affecting package docker-cli 25.0.7-5","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107363","title":"CVE-2026-78663 affecting package docker-compose 2.27.0-14","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107366","title":"CVE-2026-78663 affecting package etcd for versions less than 3.5.35-1","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-06T14:15:51.517536758Z","updated_at":"2026-11-06T14:57:15.495576Z"},{"id":"AZL-107384","title":"CVE-2026-78663 affecting package flannel 0.24.2-32","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107412","title":"CVE-2026-78663 affecting package gh 2.101.0-1","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107427","title":"CVE-2026-78663 affecting package git-lfs 3.6.1-6","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107508","title":"CVE-2026-78663 affecting package ignition-flatcar 2.22.0-6","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107523","title":"CVE-2026-78663 affecting package influxdb for versions less than 2.7.5-22","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107541","title":"CVE-2026-78663 affecting package jx 3.10.182-5","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107567","title":"CVE-2026-78663 affecting package kata-containers for versions less than 4.1.0.kata1-2","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107592","title":"CVE-2026-78663 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107616","title":"CVE-2026-78663 affecting package keda 2.14.1-19","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-31T05:32:45Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107628","title":"CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107643","title":"CVE-2026-78663 affecting package kubernetes for versions less than 1.30.10-32","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107667","title":"CVE-2026-78663 affecting package kubevirt for versions less than 1.8.4-4","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107679","title":"CVE-2026-78663 affecting package kured 1.15.0-6","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107712","title":"CVE-2026-78663 affecting package libcontainers-common 20240213-3","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107724","title":"CVE-2026-78663 affecting package moby-containerd-cc for versions less than 1.7.7-19","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-107736","title":"CVE-2026-78663 affecting package moby-engine 25.0.18-1","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-107760","title":"CVE-2026-78663 affecting package multus 4.0.2-11","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107772","title":"CVE-2026-78663 affecting package opa for versions less than 0.63.0-6","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-06T14:16:42.132820114Z","updated_at":"2026-11-06T14:57:15.495576Z"},{"id":"AZL-107796","title":"CVE-2026-78663 affecting package packer 1.9.5-21","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107814","title":"CVE-2026-78663 affecting package prometheus-adapter for versions less than 0.12.0-12","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-107829","title":"CVE-2026-78663 affecting package prometheus-node-exporter for versions less than 1.7.0-6","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-107847","title":"CVE-2026-78663 affecting package prometheus-process-exporter for versions less than 0.8.2-6","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-107874","title":"CVE-2026-78663 affecting package skopeo 1.14.4-13","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107895","title":"CVE-2026-78663 affecting package sriov-network-device-plugin 3.7.0-8","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","status":"published","published":"2026-10-08T23:17:03Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"}]},"sources_more":{"osv":43}}