{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "govulncheck/vex:10f09bef4fc8d70247fe2045f5af763075ec50700bae91a8964621af11e6ee16",
  "author": "Unknown Author",
  "timestamp": "2026-06-19T00:45:37.388814446Z",
  "version": 1,
  "tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4517",
        "name": "GO-2026-4517",
        "description": "Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime",
        "aliases": [
          "CVE-2026-24834",
          "GHSA-wwj6-vghv-5p64"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fkata-containers%2Fkata-containers%2Fsrc%2Fruntime@v0.0.0-20250828155603-754f07cff239"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4883",
        "name": "GO-2026-4883",
        "description": "Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker",
        "aliases": [
          "CVE-2026-33997",
          "GHSA-pxq6-2prw-chj9"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4887",
        "name": "GO-2026-4887",
        "description": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker",
        "aliases": [
          "CVE-2026-34040",
          "GHSA-x744-4wpc-v9h2"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5005",
        "name": "GO-2026-5005",
        "description": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent",
        "aliases": [
          "CVE-2026-39833"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5006",
        "name": "GO-2026-5006",
        "description": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent",
        "aliases": [
          "CVE-2026-39832"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5013",
        "name": "GO-2026-5013",
        "description": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-46597"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5014",
        "name": "GO-2026-5014",
        "description": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39828"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5015",
        "name": "GO-2026-5015",
        "description": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39835"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5016",
        "name": "GO-2026-5016",
        "description": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39827"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5017",
        "name": "GO-2026-5017",
        "description": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39830"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5018",
        "name": "GO-2026-5018",
        "description": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39829"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5019",
        "name": "GO-2026-5019",
        "description": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39831"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5020",
        "name": "GO-2026-5020",
        "description": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39834"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5021",
        "name": "GO-2026-5021",
        "description": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts",
        "aliases": [
          "CVE-2026-42508"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5023",
        "name": "GO-2026-5023",
        "description": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-46595"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5024",
        "name": "GO-2026-5024",
        "description": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows",
        "aliases": [
          "CVE-2026-39824"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fsys@v0.43.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5025",
        "name": "GO-2026-5025",
        "description": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-42506"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.53.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5026",
        "name": "GO-2026-5026",
        "description": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna",
        "aliases": [
          "CVE-2026-39821"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.53.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5027",
        "name": "GO-2026-5027",
        "description": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-42502"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.53.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5028",
        "name": "GO-2026-5028",
        "description": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-25680"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.53.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5029",
        "name": "GO-2026-5029",
        "description": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-25681"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.53.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5030",
        "name": "GO-2026-5030",
        "description": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-27136"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.53.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5033",
        "name": "GO-2026-5033",
        "description": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent",
        "aliases": [
          "CVE-2026-46598"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.50.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5037",
        "name": "GO-2026-5037",
        "description": "Inefficient candidate hostname parsing in crypto/x509",
        "aliases": [
          "CVE-2026-27145"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5038",
        "name": "GO-2026-5038",
        "description": "Quadratic complexity in WordDecoder.DecodeHeader in mime",
        "aliases": [
          "CVE-2026-42504"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5039",
        "name": "GO-2026-5039",
        "description": "Arbitrary inputs are included in errors without any escaping in net/textproto",
        "aliases": [
          "CVE-2026-42507"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "affected"
    }
  ]
}