{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "govulncheck/vex:68e5cbe0613030157c6fd7e8e38a08a883eb59b2f193d42b84a2ba76cdf38f8a",
  "author": "Unknown Author",
  "timestamp": "2026-07-28T17:56:40.58032301Z",
  "version": 1,
  "tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4311",
        "name": "GO-2026-4311",
        "description": "Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio",
        "aliases": [
          "CVE-2026-22772",
          "GHSA-59jp-pj84-45mr"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fsigstore%2Ffulcio@v1.8.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4358",
        "name": "GO-2026-4358",
        "description": "Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore",
        "aliases": [
          "CVE-2026-24137",
          "GHSA-fcv2-xgw5-pqxf"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fsigstore%2Fsigstore@v1.10.3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4473",
        "name": "GO-2026-4473",
        "description": "Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-25934",
          "GHSA-37cx-329c-33x3"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4517",
        "name": "GO-2026-4517",
        "description": "Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime",
        "aliases": [
          "CVE-2026-24834",
          "GHSA-wwj6-vghv-5p64"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fkata-containers%2Fkata-containers%2Fsrc%2Fruntime@v0.0.0-20250828155603-754f07cff239"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4550",
        "name": "GO-2026-4550",
        "description": "CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl",
        "aliases": [
          "CVE-2026-1229",
          "GHSA-q9hv-hpm4-hj6x"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcloudflare%2Fcircl@v1.6.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4883",
        "name": "GO-2026-4883",
        "description": "Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker",
        "aliases": [
          "CVE-2026-33997",
          "GHSA-pxq6-2prw-chj9"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4887",
        "name": "GO-2026-4887",
        "description": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker",
        "aliases": [
          "CVE-2026-34040",
          "GHSA-x744-4wpc-v9h2"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4909",
        "name": "GO-2026-4909",
        "description": "Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-33762",
          "GHSA-gm2x-2g9h-ccm8"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4910",
        "name": "GO-2026-4910",
        "description": "Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-34165",
          "GHSA-jhf3-xxhw-2wpp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4918",
        "name": "GO-2026-4918",
        "description": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net",
        "aliases": [
          "CVE-2026-33814"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4945",
        "name": "GO-2026-4945",
        "description": "Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose",
        "aliases": [
          "CVE-2026-34986",
          "GHSA-78h2-9frx-2jm8"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-jose%2Fgo-jose%2Fv4@v4.1.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4970",
        "name": "GO-2026-4970",
        "description": "Root escape via symlink plus trailing slash in os",
        "aliases": [
          "CVE-2026-39822"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5005",
        "name": "GO-2026-5005",
        "description": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent",
        "aliases": [
          "CVE-2026-39833"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5006",
        "name": "GO-2026-5006",
        "description": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent",
        "aliases": [
          "CVE-2026-39832"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5013",
        "name": "GO-2026-5013",
        "description": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-46597"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5014",
        "name": "GO-2026-5014",
        "description": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39828"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5015",
        "name": "GO-2026-5015",
        "description": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39835"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5016",
        "name": "GO-2026-5016",
        "description": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39827"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5017",
        "name": "GO-2026-5017",
        "description": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39830"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5018",
        "name": "GO-2026-5018",
        "description": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39829"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5019",
        "name": "GO-2026-5019",
        "description": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39831"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5020",
        "name": "GO-2026-5020",
        "description": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-39834"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5021",
        "name": "GO-2026-5021",
        "description": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts",
        "aliases": [
          "CVE-2026-42508"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5023",
        "name": "GO-2026-5023",
        "description": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-46595"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5024",
        "name": "GO-2026-5024",
        "description": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows",
        "aliases": [
          "CVE-2026-39824"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fsys@v0.41.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5025",
        "name": "GO-2026-5025",
        "description": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-42506"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5026",
        "name": "GO-2026-5026",
        "description": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna",
        "aliases": [
          "CVE-2026-39821"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5027",
        "name": "GO-2026-5027",
        "description": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-42502"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5028",
        "name": "GO-2026-5028",
        "description": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-25680"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5029",
        "name": "GO-2026-5029",
        "description": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-25681"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5030",
        "name": "GO-2026-5030",
        "description": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-27136"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5033",
        "name": "GO-2026-5033",
        "description": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent",
        "aliases": [
          "CVE-2026-46598"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5037",
        "name": "GO-2026-5037",
        "description": "Inefficient candidate hostname parsing in crypto/x509",
        "aliases": [
          "CVE-2026-27145"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5038",
        "name": "GO-2026-5038",
        "description": "Quadratic complexity in WordDecoder.DecodeHeader in mime",
        "aliases": [
          "CVE-2026-42504"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5039",
        "name": "GO-2026-5039",
        "description": "Arbitrary inputs are included in errors without any escaping in net/textproto",
        "aliases": [
          "CVE-2026-42507"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5064",
        "name": "GO-2026-5064",
        "description": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53492",
          "GHSA-33vj-92qq-66hc"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.30"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5074",
        "name": "GO-2026-5074",
        "description": "Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-45022",
          "GHSA-389r-gv7p-r3rp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5105",
        "name": "GO-2026-5105",
        "description": "Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-41506",
          "GHSA-3xc5-wrhm-f963"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5158",
        "name": "GO-2026-5158",
        "description": "Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel",
        "aliases": [
          "CVE-2026-41178",
          "GHSA-5wrp-cwcj-q835"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5327",
        "name": "GO-2026-5327",
        "description": "Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver",
        "aliases": [
          "CVE-2026-2303",
          "GHSA-cp6g-7hqx-qxhp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/go.mongodb.org%2Fmongo-driver@v1.17.3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5336",
        "name": "GO-2026-5336",
        "description": "Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-45571",
          "GHSA-crhj-59gh-8x96"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5338",
        "name": "GO-2026-5338",
        "description": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-50195",
          "GHSA-cvxm-645q-p574"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.30"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5378",
        "name": "GO-2026-5378",
        "description": "containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-46680",
          "GHSA-fqw6-gf59-qr4w"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.30"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5426",
        "name": "GO-2026-5426",
        "description": "Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk",
        "aliases": [
          "CVE-2026-39883",
          "GHSA-hfvc-g4fc-pqhx"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/go.opentelemetry.io%2Fotel%2Fsdk@v1.41.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5475",
        "name": "GO-2026-5475",
        "description": "containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-47262",
          "GHSA-jpcc-p29g-p8mq"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.30"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5490",
        "name": "GO-2026-5490",
        "description": "Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy",
        "aliases": [
          "CVE-2026-44740",
          "GHSA-m3xc-h892-ggx6"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-billy%2Fv5@v5.6.2"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5496",
        "name": "GO-2026-5496",
        "description": "Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-45570",
          "GHSA-m7cr-m3pv-hgrp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5597",
        "name": "GO-2026-5597",
        "description": "Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy",
        "aliases": [
          "CVE-2026-44973",
          "GHSA-qw64-3x98-g7q2"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-billy%2Fv5@v5.6.2"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5617",
        "name": "GO-2026-5617",
        "description": "Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection",
        "aliases": [
          "CVE-2026-42306",
          "GHSA-rg2x-37c3-w2rh"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5622",
        "name": "GO-2026-5622",
        "description": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53489",
          "GHSA-rgh6-rfwx-v388"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.30"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5668",
        "name": "GO-2026-5668",
        "description": "Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap in github.com/docker/docker",
        "aliases": [
          "CVE-2026-41568",
          "GHSA-vp62-88p7-qqf5"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5693",
        "name": "GO-2026-5693",
        "description": "Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git",
        "aliases": [
          "GHSA-w5pp-99ch-qj29"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.16.3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5746",
        "name": "GO-2026-5746",
        "description": "Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker",
        "aliases": [
          "CVE-2026-41567",
          "GHSA-x86f-5xw2-fm2r"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5758",
        "name": "GO-2026-5758",
        "description": "containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53488",
          "GHSA-xhf5-7wjv-pqxp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.30"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5761",
        "name": "GO-2026-5761",
        "description": "Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc",
        "aliases": [
          "CVE-2026-41579",
          "GHSA-xjvp-4fhw-gc47"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fopencontainers%2Frunc@v1.4.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5774",
        "name": "GO-2026-5774",
        "description": "Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi",
        "aliases": [
          "GHSA-3fxj-6jh8-hvhx"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-chi%2Fchi%2Fv5@v5.2.5"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5775",
        "name": "GO-2026-5775",
        "description": "Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi",
        "aliases": [
          "GHSA-9g5q-2w5x-hmxf"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-chi%2Fchi%2Fv5@v5.2.5"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5777",
        "name": "GO-2026-5777",
        "description": "Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi",
        "aliases": [
          "GHSA-rjr7-jggh-pgcp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-chi%2Fchi%2Fv5@v5.2.5"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5841",
        "name": "GO-2026-5841",
        "description": "OOB read in github.com/klauspost/compress/s2",
        "aliases": [
          "GHSA-259r-337f-4rfw"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fklauspost%2Fcompress@v1.18.3"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5853",
        "name": "GO-2026-5853",
        "description": "Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio",
        "aliases": [
          "CVE-2026-49478",
          "GHSA-f5mr-q85p-6hh6"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fsigstore%2Ffulcio@v1.8.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5856",
        "name": "GO-2026-5856",
        "description": "Invoking Encrypted Client Hello privacy leak in crypto/tls",
        "aliases": [
          "CVE-2026-42505"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.3"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5932",
        "name": "GO-2026-5932",
        "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.48.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5942",
        "name": "GO-2026-5942",
        "description": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage",
        "aliases": [
          "CVE-2026-46600"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.51.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5970",
        "name": "GO-2026-5970",
        "description": "Infinite loop on invalid input in golang.org/x/text",
        "aliases": [
          "CVE-2026-56852"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Ftext@v0.34.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6061",
        "name": "GO-2026-6061",
        "description": "Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc",
        "aliases": [
          "GHSA-hrxh-6v49-42gf"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/google.golang.org%2Fgrpc@v1.79.3"
            }
          ]
        }
      ],
      "status": "affected"
    }
  ]
}