{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "govulncheck/vex:0bff9902a5c0c8414a47604b5dd13646427ac1c9f6954cf747709074be1e6d71",
  "author": "Unknown Author",
  "timestamp": "2026-10-30T10:14:48.261221168Z",
  "version": 1,
  "tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4517",
        "name": "GO-2026-4517",
        "description": "Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime",
        "aliases": [
          "CVE-2026-24834",
          "GHSA-wwj6-vghv-5p64"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fkata-containers%2Fkata-containers%2Fsrc%2Fruntime@v0.0.0-20250828155603-754f07cff239"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5064",
        "name": "GO-2026-5064",
        "description": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53492",
          "GHSA-33vj-92qq-66hc"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5338",
        "name": "GO-2026-5338",
        "description": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-50195",
          "GHSA-cvxm-645q-p574"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5622",
        "name": "GO-2026-5622",
        "description": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53489",
          "GHSA-rgh6-rfwx-v388"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5932",
        "name": "GO-2026-5932",
        "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6179",
        "name": "GO-2026-6179",
        "description": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog",
        "aliases": [
          "CVE-2026-56865"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fmod@v0.39.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6180",
        "name": "GO-2026-6180",
        "description": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb",
        "aliases": [
          "CVE-2026-56864"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fmod@v0.39.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6354",
        "name": "GO-2026-6354",
        "description": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-78662"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6355",
        "name": "GO-2026-6355",
        "description": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-56855"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6597",
        "name": "GO-2026-6597",
        "description": "Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53493",
          "GHSA-pg57-6jwg-q645"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6599",
        "name": "GO-2026-6599",
        "description": "Reset context tracking on consecutive template expressions in html/template",
        "aliases": [
          "CVE-2026-94448"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6600",
        "name": "GO-2026-6600",
        "description": "Recognize yield as regexp preceder keyword in html/template",
        "aliases": [
          "CVE-2026-97030"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6603",
        "name": "GO-2026-6603",
        "description": "HTTP/2 server memory exhaustion due to Trailer headers in net/http",
        "aliases": [
          "CVE-2026-78659"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            },
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.58.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6604",
        "name": "GO-2026-6604",
        "description": "Root.Mkdir(All) can follow junctions out of the root on Windows in os",
        "aliases": [
          "CVE-2026-56857"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6605",
        "name": "GO-2026-6605",
        "description": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http",
        "aliases": [
          "CVE-2026-56866"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6607",
        "name": "GO-2026-6607",
        "description": "Reject malformed ECH outer extension references in crypto/tls",
        "aliases": [
          "CVE-2026-97031"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6608",
        "name": "GO-2026-6608",
        "description": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart",
        "aliases": [
          "CVE-2026-94440"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6609",
        "name": "GO-2026-6609",
        "description": "Lack of limit on size of parsed Range headers in net/http",
        "aliases": [
          "CVE-2026-78667"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6610",
        "name": "GO-2026-6610",
        "description": "HTTP/2 transport accepts malformed framing-related headers in net/http",
        "aliases": [
          "CVE-2026-78660"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            },
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.58.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6611",
        "name": "GO-2026-6611",
        "description": "Excessive CPU consumption from repeated initial window changes in net/http",
        "aliases": [
          "CVE-2026-78669"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.58.0"
            },
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6612",
        "name": "GO-2026-6612",
        "description": "Double flow control refund on HTTP/2 server streams in net/http",
        "aliases": [
          "CVE-2026-78663"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.58.0"
            },
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6613",
        "name": "GO-2026-6613",
        "description": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http",
        "aliases": [
          "CVE-2026-94439"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6617",
        "name": "GO-2026-6617",
        "description": "HTTP/2 server crash due to HPACK encoder race in net/http",
        "aliases": [
          "CVE-2026-97032"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            },
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.58.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6791",
        "name": "GO-2026-6791",
        "description": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-95837",
          "GHSA-p7v4-vr35-mj6f"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6809",
        "name": "GO-2026-6809",
        "description": "Distrust compromised intermediate certificates in crypto/x509",
        "aliases": [
          "CVE-2026-111943"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6860",
        "name": "GO-2026-6860",
        "description": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net",
        "aliases": [
          "CVE-2026-78661"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.58.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6866",
        "name": "GO-2026-6866",
        "description": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net",
        "aliases": [
          "CVE-2026-97045"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.58.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    }
  ]
}